CVE-2024-38814: VMware HCX SQL Injection Vulnerability

CVE-2024-38814 Overview

CVE-2024-38814 is an authenticated SQL injection vulnerability in VMware HCX that allows a non-administrator user to execute arbitrary code on the HCX Manager. Attackers submit specially crafted SQL queries through an authenticated interface and gain remote code execution on the appliance. Broadcom privately received the report and has published fixed versions. The flaw is tracked as CWE-89 and affects the HCX Manager component used to migrate and rebalance workloads across data centers and clouds.

Critical Impact
A low-privileged authenticated user can execute arbitrary code on the HCX Manager, compromising the appliance that orchestrates cross-cloud VM migration and network extension.

Affected Products

VMware HCX 4.8.x prior to the fixed release
VMware HCX 4.9.x prior to the fixed release
VMware HCX 4.10.0

Discovery Timeline

2024-10-16 - CVE-2024-38814 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38814

Vulnerability Analysis

The vulnerability resides in an authenticated code path on the HCX Manager that constructs SQL statements from user-supplied input without proper parameterization. An attacker who holds any valid HCX account, including one with only non-administrator privileges, can inject SQL syntax into a request parameter. The database engine executes the injected statement in the context of the HCX service account, which the attacker leverages to write files or invoke commands on the underlying appliance.

Because HCX Manager runs migration, network extension, and disaster recovery workflows, code execution on this component exposes vCenter credentials, replication data, and inter-site tunnels. The attack requires network reachability to the HCX Manager management interface and valid credentials, but no user interaction.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Input flowing from an authenticated HTTP endpoint reaches a database query without prepared statements or strict allow-list validation. The injection primitive is powerful enough to chain into command execution on the HCX Manager appliance, rather than being limited to data exfiltration.

Attack Vector

Exploitation follows a standard authenticated SQL injection pattern. The attacker authenticates to HCX Manager with a low-privileged account, identifies the vulnerable endpoint, and issues a crafted request containing SQL metacharacters in a parameter that is concatenated into a backend query. The injected payload manipulates the query result or invokes database-layer functionality that leads to remote code execution on the HCX Manager host. No verified public proof-of-concept code is currently available; refer to the Broadcom Security Advisory for vendor detail.

Detection Methods for CVE-2024-38814

Indicators of Compromise

Unexpected child processes spawned by the HCX Manager database or web service accounts.
HTTP request logs on the HCX appliance containing SQL metacharacters such as ', --, UNION, or ; in parameters submitted by non-administrator sessions.
New or modified files under HCX Manager web directories or cron paths that were not introduced by a Broadcom-signed upgrade.
Outbound connections from the HCX Manager to hosts that are not vCenter, NSX, or paired HCX peers.

Detection Strategies

Enable verbose access logging on the HCX Manager and alert on authenticated requests from accounts that do not normally interact with administrative APIs.
Deploy database query auditing to flag statements containing stacked queries or filesystem functions originating from the HCX application user.
Correlate authentication events with subsequent process creation on the appliance to identify escalation from a low-privileged session to shell activity.

Monitoring Recommendations

Forward HCX Manager application, audit, and OS logs to a central SIEM for retention and correlation.
Baseline outbound network traffic from HCX Manager and alert on deviations that could indicate a reverse shell or data staging.
Monitor for creation of new local accounts or SSH keys on the HCX Manager appliance.

How to Mitigate CVE-2024-38814

Immediate Actions Required

Upgrade VMware HCX to the fixed builds listed in the Broadcom Security Advisory for the 4.8, 4.9, and 4.10 branches.
Restrict network access to the HCX Manager management interface to a limited set of administrator jump hosts.
Audit HCX user accounts and remove or disable non-administrator accounts that no longer require access.
Rotate credentials associated with HCX, vCenter, and NSX integrations if compromise is suspected.

Patch Information

Broadcom has released fixed versions of VMware HCX for the 4.8, 4.9, and 4.10 branches. Consult the Broadcom Security Advisory for the specific fixed build numbers and upgrade guidance for each release train.

Workarounds

No official workaround is provided by Broadcom; upgrading is the supported remediation.
Reduce exposure by placing HCX Manager behind a management VLAN with strict access control lists.
Enforce strong authentication and multi-factor authentication for every account that can reach the HCX Manager UI or API.

bash

# Example: restrict HCX Manager management access with iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP