Vates Xen Orchestra Authentication Bypass and Zero-Day Exploitation

Vates has issued a warning regarding active exploitation of two vulnerabilities in Xen Orchestra, a backup and management solution for XCP-ng and XenServer environments. The first is a critical authentication bypass in the REST API mechanism, triggered by an empty authentication token, which allows attackers to impersonate valid users and gain administrator privileges. The second is an unpatched zero-day vulnerability allowing malicious VM imports that result in host compromise. No CVE identifiers have been assigned to these flaws.

Attack Chain

1. Attacker establishes initial contact via 91.211.251.112:8001 or Tor network.
2. Attacker exploits an empty token vulnerability in the Xen Orchestra REST authentication mechanism to bypass authentication.
3. Attacker gains unauthorized administrator access to the Xen Orchestra interface.
4. Attacker leverages a zero-day vulnerability related to VM imports to gain access to XCP-ng hosts.
5. Attacker executes arbitrary code as root on the underlying virtualization host.
6. Attacker establishes persistent access or backdoors on the compromised virtualization node.

Impact

Confirmed compromise leads to full root-level takeover of XCP-ng virtualization nodes. Cleanup efforts are considered unreliable by the vendor, and a full reinstallation of affected nodes is recommended following a confirmed incident.

Recommendation

• Upgrade Xen Orchestra to version 6.9.2 (stable) or 6.10.1 (latest) or higher immediately.
• Rotate all administrative and service credentials for the Xen Orchestra environment.
• Isolate Xen Orchestra instances behind a dedicated management network.
• Implement a WAF rule to block empty authentication tokens in REST API requests.
• Conduct a full reinstallation of systems where compromise is confirmed.
• Block communication with the observed malicious infrastructure (91.211.251.112).