VeloCloud Orchestrator flaw that lets any user act as superuser is exploited
- Affected
- On-premises VeloCloud Orchestrator
5.2,6.1and6.4before the fixed builds in Arista’s advisory. All versions and fixes
- CVE
- Vendor
- Arista Networks
Arista says attackers are exploiting a flaw in on-premises VeloCloud Orchestrator that lets any signed-in user gain operator privileges and act as its local “superuser operator.” Enterprise Read Only, the lowest built-in tenant role, is enough, and the orchestrator is exposed by default. Arista rates the SQL injection flaw 9.9 and lists fixed builds for the 5.2, 6.1 and 6.4 trains. Its hosted orchestrators, including Dedicated ones, are already patched.
Arista says it detected the flaw itself and that it’s known to be actively exploited. On an affected orchestrator, a user with any valid session can reach functions meant only for internal use. An attack may also affect the host it runs on and the data the orchestrator manages. No configuration can prevent the exposure, Arista says. It hasn’t said when the attacks began or how many customers they reached.
Arista lists two addresses it saw conducting the attacks. It says to look in the orchestrator’s web access logs for requests with unusual URL-like path components, encoded characters, references to local or internal services, or high request rates. It also says to watch the host for backdoor daemons, web shells and unexpected outbound traffic.
Arista’s advisory lists the first fixed build for each train. It hasn’t assessed versions past their end of support, and it asks customers on other trains to contact its support center about upgrades. VeloCloud Gateway and VeloCloud Edge aren’t affected. CISA hasn’t added the flaw to its KEV catalog.
- CVE
- Vendor
- Arista Networks
What to do
7 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| VeloCloud Orchestrator 5.2, on-premises | Builds before the fixed one | The fixed 5.2 build in Arista’s advisory, or later |
| VeloCloud Orchestrator 6.1, on-premises | Builds before the fixed one | The fixed 6.1 build in Arista’s advisory, or later |
| VeloCloud Orchestrator 6.4, on-premises | Builds before the fixed one | The fixed 6.4 build in Arista’s advisory, or later |
| VeloCloud Orchestrator, hosted and Dedicated | Patched by Arista | No action needed |
- Product
- VeloCloud Orchestrator 5.2, on-premises
- Affected
- Builds before the fixed one
- Fixed
- The fixed
5.2build in Arista’s advisory, or later
- Product
- VeloCloud Orchestrator 6.1, on-premises
- Affected
- Builds before the fixed one
- Fixed
- The fixed
6.1build in Arista’s advisory, or later
- Product
- VeloCloud Orchestrator 6.4, on-premises
- Affected
- Builds before the fixed one
- Fixed
- The fixed
6.4build in Arista’s advisory, or later
- Product
- VeloCloud Orchestrator, hosted and Dedicated
- Affected
- Patched by Arista
- Fixed
- No action needed
Indicators
IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| IP address | Seen conducting the attacks, Arista says | |
| IP address | Seen conducting the attacks, Arista says |
- IP addressSeen conducting the attacks, Arista says
- IP addressSeen conducting the attacks, Arista says
Sources
- Arista advisoryPrimary source arista.com