Executive brief
Xen Orchestra is a web-based management platform for Xen hypervisors. An authenticated attacker can manipulate WebSocket responses to escalate their privileges from user to admin, gaining unauthorized access to sensitive data including virtual machines, backups, audit logs, users, and groups.
Technical details
The vulnerability is an improper authorization check (CWE-863) in Xen Orchestra's WebSocket API. The resourceSet.getAll method returns permission levels in the API response, which the client-side code trusts without server-side re-validation. An authenticated attacker can intercept and modify the permission field from "none" to "admin" in the WebSocket response, and the backend accepts this forged permission level for subsequent API calls. The attack requires a valid user account and network access to the WebSocket API. While some methods include additional permission checks, the initial authorization bypass allows access to sensitive data and API endpoints.
Affected products
- Xen Orchestra xo-web through 5.80.0
- Xen Orchestra xo-server through 5.84.0
Timeline
- 2021-04-05: disclosed: Issue opened on GitHub
- 2021-07-12: other: CVE-2021-36383 published
- 2022-05-24: advisory: GHSA-grvm-gcqf-gh8q published