CVE-2023-20891: VMware Isolation Segment Disclosure Flaw

CVE-2023-20891 Overview

CVE-2023-20891 is an information disclosure vulnerability affecting VMware Tanzu Application Service for Virtual Machines (TAS for VMs) and VMware Isolation Segment. The platform writes Cloud Foundry (CF) API administrator credentials into system audit logs using hex encoding. A non-administrative user with read access to those logs can decode the credentials and authenticate as a CF API admin. With those credentials, the attacker can push malicious application versions into the platform. In a default deployment, non-admin users do not have access to platform system audit logs, which limits exposure. The weakness is classified as CWE-532 (Insertion of Sensitive Information into Log File).

Critical Impact
An authenticated low-privilege user with audit log access can recover CF API admin credentials and deploy malicious application versions across the platform.

Affected Products

VMware Tanzu Application Service for Virtual Machines
VMware Isolation Segment
Deployments where non-admin operators are granted read access to platform system audit logs

Discovery Timeline

2023-07-26 - CVE-2023-20891 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-20891

Vulnerability Analysis

The vulnerability stems from the platform writing sensitive authentication material into system audit logs. The credentials are stored in hex encoding rather than plaintext, but hex encoding is a trivially reversible transformation and provides no confidentiality protection. Any actor able to read the audit log file can convert the hex stream back to the original CF API admin credentials.

With those credentials, an attacker authenticates to the Cloud Foundry API as an administrator. From there, they can push new application versions, replacing trusted workloads with attacker-controlled code that runs inside the platform. This produces a supply-chain style impact on hosted applications even though the initial access required is only network reachability and a low-privileged account.

The issue is scoped to confidentiality, since the logged data is the credential itself rather than an integrity or availability primitive. The current EPSS exploit probability is approximately 0.281%.

Root Cause

The root cause is improper handling of sensitive data during audit log generation. The logging subsystem encodes CF API admin credentials as hex strings and emits them into platform system audit logs instead of redacting, hashing, or omitting them. Hex encoding is a presentation format, not a cryptographic control, so the credentials remain effectively in cleartext for any reader of the log.

Attack Vector

The attacker authenticates as a non-admin user that has been granted access to the platform system audit logs. The attacker reads the audit log, locates the hex-encoded credential strings, and decodes them to recover the CF API admin username and password. Using those recovered credentials, the attacker calls the CF API to push a malicious application revision. No user interaction is required, and the attack is performed over the network against the Cloud Foundry control plane.

No public proof-of-concept exploit code is available for CVE-2023-20891. Refer to the VMware Security Advisory VMSA-2023-0016 for vendor technical details.

Detection Methods for CVE-2023-20891

Indicators of Compromise

Unexpected cf push or application revision events authored by the CF API admin account, especially from unusual source addresses or outside change windows.
Read access to platform system audit log paths by accounts that are not part of the platform operations team.
New application droplets or buildpacks introduced shortly after audit log access by a non-admin user.
Hex-encoded strings present in archived audit logs that decode to credential-like values.

Detection Strategies

Inspect platform system audit logs for hex-encoded credential patterns and flag any historical occurrences for rotation.
Correlate audit log read events with subsequent CF API authentication and application push activity from the admin identity.
Alert on any CF API admin login that does not originate from approved operator workstations or jump hosts.

Monitoring Recommendations

Forward Tanzu Application Service audit logs and CF API access logs to a centralized analytics platform for retention and correlation.
Track all role and permission changes that grant audit log read access to non-admin principals.
Monitor application lifecycle events (push, restage, restart) for the CF API admin account and review them against approved change tickets.

How to Mitigate CVE-2023-20891

Immediate Actions Required

Apply the fixed releases listed in VMware Security Advisory VMSA-2023-0016 for Tanzu Application Service for VMs and Isolation Segment.
Rotate the CF API admin credentials and any other credentials that may have been written to audit logs prior to patching.
Audit which accounts currently have read access to platform system audit logs and remove access that is not strictly required.
Review CF application push history for unauthorized revisions deployed by the admin account.

Patch Information

VMware addressed CVE-2023-20891 in updated releases of Tanzu Application Service for VMs and Isolation Segment. Consult VMware Security Advisory VMSA-2023-0016 for the fixed version numbers that correspond to each supported release line, and upgrade to a fixed build.

Workarounds

Restrict platform system audit log access to administrators only, matching the default deployment posture.
Purge or sanitize archived audit logs that contain hex-encoded credential material after credential rotation.
Enforce multi-factor authentication and source IP restrictions on the CF API admin account to limit value of any leaked credential.

bash

# Configuration example: verify which UAA users hold audit log read scopes
uaac target https://uaa.<system-domain>
uaac token client get admin -s <admin-client-secret>
uaac users -a userName,groups | grep -i 'audit'

# Remove audit log read scope from a non-admin user
uaac member delete cloud_controller.admin_read_only <username>