Server Spoofing Vulnerability in NxCloud

Vulnerability

A server spoofing vulnerability exists in Network Optix NxCloud before version 23.1.0.40440. The bug allows an attacker to add a fake VMS server to NxCloud by reusing the exact identification of a legitimate VMS server. Any VMS server connected to the Cloud is affected [1].

Exploitation

The attacker must be able to register a fake VMS server with the same identifier as a legitimate one. When a legitimate client subsequently connects to the fake server, the attacker can capture the client's authorization headers. The vendor notes that exploitation is relatively hard and requires multiple prerequisites [1].

Impact

A successful attack enables a man-in-the-middle scenario where the attacker gains access to authorization headers from legitimate users, leading to potential unauthorized access to the VMS server and disclosure of sensitive information [1].

Mitigation

The fix was deployed on the cloud side on September 22, 2023, and requires no action from VMS server owners [1]. As an immediate mitigation, users are advised to change the VMS server owner's ("admin") local password and perform a users and permissions review [1].