Loading vulnerability…
CVE-2024-37081 is a local privilege escalation vulnerability affecting VMware vCenter Server, specifically the vCenter Server Appliance. The issue is caused by improper sudo configuration that exposes multiple privilege escalation paths to authenticated local users who do not already have administrative privileges. By abusing the misconfigured sudo rules, a non-administrative local user can execute actions with elevated privileges and ultimately obtain root access on the appliance.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (modules/exploits/linux/local/vcenter_sudo_lpe.rb) that exploits CVE-2024-37081, a local privilege escalation vulnerability in VMware vCenter Server Appliance (VCSA) versions prior to 7.0.3 update R and 8.0.2 update D. The exploit leverages misconfigurations in sudo and environment variables to execute arbitrary code as root by abusing specific scripts and binaries on the appliance. The module checks the vCenter build version and user group membership to determine exploitability, then uses one of three methods (PYTHONPATH, VMWARE_PYTHON_PATH, or VMWARE_PYTHON_BIN) to hijack execution flow and run a custom payload as root. The payload is a binary generated by Metasploit, uploaded to a writable directory (default: /tmp), and executed via the targeted script. The exploit is operational and provides root access if successful. The repository is structured as a standard Metasploit module and is intended for use within the Metasploit Framework.
This repository provides a proof-of-concept (PoC) exploit for CVE-2024-37081, a local privilege escalation vulnerability in VMware vCenter due to improper configuration of the /etc/sudoers file. The repository contains two files: a README.md with detailed vulnerability and usage information, and poc.py, a Python script that demonstrates the exploit. The script creates a malicious Python module in /tmp/malicious/__init__.py, sets environment variables (PYTHONPATH, VMWARE_PYTHON_PATH, VMWARE_PYTHON_BIN) to point to malicious code or scripts, and uses sudo to execute commands as privileged users (operator, pod, admin, vpxd). It attempts to execute arbitrary code as root (demonstrated by writing the output of 'id' to /tmp/pwned) and to read sensitive files like /etc/shadow. The exploit is a local privilege escalation PoC and requires sudo access and a vulnerable sudoers configuration. No network endpoints are involved; all actions are performed locally on the target system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Local privilege escalation vulnerability in VMware vCenter Server due to sudo misconfiguration, requiring local authenticated access.
Privilege escalation vulnerability in VMware vCenter Server caused by improper sudo configuration, allowing a local authenticated non-admin attacker to escalate privileges to root.
A local privilege escalation vulnerability in VMware vCenter Server caused by sudo misconfiguration.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.