CVE-2023-20887

What it actually does

CVE-2023-20887 is an unauthenticated network-reachable command injection flaw in VMware Aria Operations for Networks, formerly vRealize Network Insight. An attacker who can reach the appliance management interface can submit crafted input that is incorporated into an operating-system command, causing attacker-controlled commands to execute on the appliance. Because exploitation requires no credentials, no user interaction, and has high confidentiality, integrity, and availability impact, successful exploitation can lead to full remote code execution, credential and configuration theft, persistence on the appliance, lateral movement using collected network-management data, or service disruption.

Why it matters to the business

This vulnerability affects a security and network-visibility platform that often has broad insight into infrastructure, flows, credentials, integrations, and topology. Compromise can expose sensitive operational data, give attackers a foothold inside management networks, and disrupt monitoring capabilities during an incident. The vulnerability is in CISA KEV, has a very high EPSS score, and is known to be actively exploited in the wild, so unpatched internet-exposed or broadly reachable appliances should be treated as high-priority incident-response targets. CISA’s KEV remediation deadline was 2023-07-13, meaning organizations subject to BOD 22-01 should already have remediated or removed exposure.

How an attack unfolds

An attacker first identifies a reachable VMware Aria Operations for Networks appliance, commonly by scanning for the web interface or known Aria/vRealize Network Insight service paths. The attacker then sends a crafted unauthenticated request to a vulnerable service endpoint that causes user-supplied data to be evaluated as part of a system command. If successful, the appliance executes the injected command with the privileges of the vulnerable service. Attackers typically use the first command to verify execution, then download or stage tooling using utilities such as curl, wget, bash, sh, python, nc, or ncat. Post-exploitation activity may include spawning a reverse shell, creating persistence, collecting appliance configuration and logs, harvesting credentials or integration tokens, enumerating internal networks visible to the product, and using the appliance as a pivot point for further attacks.

How to fix it

Upgrade VMware Aria Operations for Networks to a vendor-fixed release or apply the relevant VMware security patch from VMSA-2023-0012 and associated VMware guidance. VMware fixed this issue in Aria Operations for Networks 6.11 and later; deployments running older vulnerable 6.x releases should be upgraded to a fixed supported version. If immediate patching is not possible, restrict access to the appliance management and API interfaces to trusted administrative networks only, block internet exposure, enforce network-layer allowlisting, monitor for suspicious requests and command execution, and consider temporarily isolating or shutting down exposed appliances until remediation is complete. After patching, rotate credentials, API tokens, and integration secrets stored on or used by the appliance if compromise cannot be confidently ruled out.

How to confirm the fix worked

Confirm the installed VMware Aria Operations for Networks version is a fixed release, preferably 6.11 or later, or that the vendor-supplied patch for the affected version has been applied. Validate that the appliance web and API interfaces are not exposed to untrusted networks and are reachable only from approved administrative segments. Review appliance update history and VMware build information through the administrative console or command-line version checks. From a vulnerability-management perspective, rescan the appliance with authenticated version detection where possible rather than relying only on banner checks. From a security-validation perspective, confirm that known vulnerable unauthenticated service paths no longer allow command execution and that requests containing shell metacharacters are rejected or safely handled. If exploitation was suspected before patching, perform incident-response validation in addition to version validation, including log review, process review, filesystem triage, and credential rotation.

Typical attack path

1. Scan for VMware Aria Operations for Networks or vRealize Network Insight appliances reachable over the network.
2. Confirm the appliance is a vulnerable version or test for the vulnerable command-injection behavior.
3. Send a crafted unauthenticated HTTP request to the vulnerable service endpoint to inject an operating-system command.
4. Execute a benign command such as id, whoami, uname, or sleep to confirm code execution.
5. Stage a payload or reverse shell using built-in tools such as bash, sh, curl, wget, python, nc, or ncat.
6. Establish interactive access to the appliance and enumerate running services, files, credentials, integrations, and network data.
7. Use the appliance’s privileged visibility and management-network access to support lateral movement, data theft, persistence, or disruption.

How to detect it

Review appliance web, reverse-proxy, application, and system logs for unauthenticated requests to Aria Operations for Networks service endpoints followed by command execution, outbound network connections, or file writes. Prioritize logs around initial suspicious access, upgrade windows, and any period before remediation. Relevant sources include web access logs, application/service logs, syslog, authentication logs, shell history, process accounting if enabled, EDR telemetry, firewall/proxy logs, DNS logs, and NetFlow. Look for requests containing shell metacharacters, encoded command payloads, unexpected POSTs to internal service paths, or references to common execution utilities. On the host, look for application services spawning shells or download utilities, unexpected files in temporary directories, new cron jobs or systemd units, modified SSH authorized_keys files, and outbound connections to unfamiliar hosts. Network detections should flag Aria Operations for Networks appliances initiating unusual external connections, especially immediately after suspicious HTTP requests. Because public exploitation exists and the issue is in KEV, absence of a single known IOC is not sufficient; combine endpoint, network, and log review to assess compromise.

• /saas./resttosaasservlet
• /saas/resttosaasservlet
• POST /saas./resttosaasservlet
• POST /saas/resttosaasservlet
• Content-Type: application/x-thrift
• ;id
• ;whoami
• ;uname
• ;curl
• ;wget
• |bash
• |sh
• bash -c
• sh -c
• /bin/bash -i
• /bin/sh -i
• nc -e
• ncat -e
• python -c
• python3 -c
• /tmp/
• /var/tmp/
• /dev/shm/
• /root/.ssh/authorized_keys
• /home/ubuntu/.ssh/authorized_keys
• crontab -e
• /etc/cron.d/
• /etc/systemd/system/
• curl http://
• curl https://
• wget http://
• wget https://
• /var/log/nginx/access.log
• /var/log/nginx/error.log
• /var/log/syslog
• /var/log/auth.log
• /var/log/arkin/

What your security team should do

• Immediately identify all VMware Aria Operations for Networks and legacy vRealize Network Insight appliances, including lab, disaster-recovery, and decommissioned instances that may still be reachable.
• Prioritize patching or upgrading all affected appliances to a fixed release because the vulnerability is unauthenticated, remotely exploitable, listed in CISA KEV, and actively exploited in the wild.
• Remove internet exposure and restrict access to management and API interfaces to trusted administrative networks using firewall rules, VPN, or zero-trust access controls.
• Hunt for exploitation before assuming patching is sufficient, focusing on suspicious HTTP requests, command execution by application services, reverse-shell behavior, and unexpected outbound connections.
• If evidence of compromise exists or logs are incomplete, treat the appliance as potentially compromised: isolate it, preserve forensic evidence, rebuild from trusted media where appropriate, and rotate credentials, tokens, and integration secrets.
• Add SIEM detections for suspicious requests to Aria/vRealize Network Insight service endpoints and for child processes spawned by web or application service accounts.
• Monitor for outbound connections from the appliance to unusual external IPs, especially high ports or command-and-control-like traffic initiated shortly after suspicious web requests.
• Document KEV status and the missed 2023-07-13 remediation deadline in risk tracking for any remaining vulnerable systems.