CVE-2024-38815: VMware NSX Content Spoofing Vulnerability

CVE-2024-38815 Overview

CVE-2024-38815 is a content spoofing vulnerability in VMware NSX. An unauthenticated attacker can craft a malicious URL that redirects a victim to an attacker-controlled domain. Successful exploitation can lead to sensitive information disclosure, including credentials submitted on the spoofed destination.

The flaw is classified under [CWE-79] and requires user interaction. The attack executes over the network without prior authentication. Broadcom published details in Security Advisory #25047.

Critical Impact
Attackers can weaponize trusted NSX URLs to redirect users to attacker-controlled domains, enabling phishing campaigns and disclosure of sensitive information supplied by the victim.

Affected Products

VMware NSX (see Broadcom Security Advisory #25047 for affected versions)
VMware NSX-T Data Center deployments
Broadcom-supported NSX distributions

Discovery Timeline

2024-10-09 - CVE-2024-38815 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38815

Vulnerability Analysis

The vulnerability enables content spoofing through URL manipulation in VMware NSX. An attacker crafts a URL that appears to originate from a legitimate NSX endpoint but redirects the browser to an external domain the attacker controls. The victim, trusting the initial NSX hostname, follows the link and interacts with attacker-supplied content.

Content spoofing differs from reflected script execution because the attacker does not need to inject executable code. Instead, the attacker abuses insufficient validation of user-controllable input reflected in the response or redirect chain. The result is a page or destination that misleads the user about its origin.

Exploitation requires the victim to click a crafted link. Because the vector operates over the network and needs no authentication, phishing campaigns targeting NSX administrators are the most likely delivery method. The EPSS score is 0.321% (percentile 22.679), indicating low observed exploitation activity to date.

Root Cause

The root cause is improper neutralization of input used in URL redirection or reflected response content within NSX web components. Input that should be validated against an allowlist of trusted destinations is instead trusted and echoed to the client. See Broadcom Security Advisory #25047 for component-level details.

Attack Vector

An unauthenticated attacker constructs a URL referencing an NSX endpoint with malicious parameters. The attacker delivers the URL through email, chat, or web content. When the victim clicks the link, the NSX response redirects the browser or renders spoofed content that impersonates the NSX interface. The victim may then submit credentials or sensitive data to the attacker.

No verified proof-of-concept code is available. Refer to the Broadcom advisory for technical remediation guidance.

Detection Methods for CVE-2024-38815

Indicators of Compromise

Inbound HTTP requests to NSX endpoints containing encoded external URLs, suspicious redirect parameters, or unusual query string content
NSX access logs showing referrers or user agents inconsistent with normal administrator activity
Reports from users describing NSX links that led to unfamiliar login pages or domains

Detection Strategies

Inspect NSX HTTP request logs for parameters carrying fully qualified URLs or scheme prefixes such as http:// and https://
Correlate outbound DNS queries from administrator workstations with click activity on NSX-hosted links
Deploy web application firewall (WAF) rules that flag reflected URL parameters and open-redirect patterns targeting NSX management endpoints

Monitoring Recommendations

Forward NSX Manager and load balancer access logs to a centralized SIEM for URL parameter analysis
Enable alerting on unusual referer chains originating from NSX hostnames toward external domains
Monitor identity provider logs for credential submissions immediately following NSX link interactions

How to Mitigate CVE-2024-38815

Immediate Actions Required

Apply the fixed VMware NSX versions listed in Broadcom Security Advisory #25047
Restrict NSX Manager access to administrative networks and jump hosts
Educate NSX administrators to verify destination domains before submitting credentials

Patch Information

Broadcom released fixed builds addressing CVE-2024-38815. Consult Broadcom Security Advisory #25047 for the specific NSX versions and upgrade paths. Apply the patch during the next available maintenance window and validate management-plane functionality after upgrade.

Workarounds

Place NSX management interfaces behind a reverse proxy or WAF that strips or validates redirect parameters
Enforce strict referer and Content-Security-Policy (CSP) headers on NSX-hosted responses where supported
Require multi-factor authentication on all NSX administrator accounts to reduce the impact of credential capture

bash

# Example WAF rule concept to block reflected external URLs in NSX parameters
# Replace <nsx-host> with your NSX Manager hostname
SecRule REQUEST_URI "@rx (https?%3A%2F%2F|https?://)" \
  "id:1003815,phase:1,deny,status:400,\
   msg:'Potential open redirect targeting NSX (CVE-2024-38815)',\
   chain"
  SecRule REQUEST_HEADERS:Host "@streq <nsx-host>"