Vulnerabilities · Cloud Security
Xen Orchestra flaw lets attackers hijack virtual machine servers
A critical flaw in Xen Orchestra lets attackers bypass authentication and take over XCP-ng virtualisation servers. The vendor has released a fix and shared signs of compromise.
Ross Grant2 min read
The short version
A serious security flaw in Xen Orchestra, a tool used to manage virtual servers, has let attackers break in and take over systems. The company behind the software has released an update to fix the problem. If you use Xen Orchestra, you should update it right away and check for signs of attack. This issue is confirmed by the vendor but so far only reported by one news outlet.
What happened?
A critical vulnerability in Xen Orchestra lets attackers bypass authentication and gain admin control of XCP-ng virtualisation servers. The vendor, Vates, has confirmed active exploitation and released a fix. Indicators of compromise and mitigation steps have been published.
How the flaw works
A critical vulnerability in Xen Orchestra, a web-based management tool for XCP-ng virtualisation, is being exploited to take over servers. According to BleepingComputer (opens in a new tab), the flaw allows attackers to bypass authentication by abusing how Xen Orchestra processes authentication cookies. Once in, attackers can access the REST API and retrieve reusable login token IDs, giving them admin-level control.
Vates, the company behind Xen Orchestra, warns that a compromise can lead to arbitrary code execution on managed pools and a full takeover of XCP-ng nodes as the root user. This means attackers could run any command or program on the affected servers.
Who is affected
Xen Orchestra is used by organisations running XCP-ng virtualisation environments. The flaw affects deployments that have not yet installed the latest patched versions: Xen Orchestra 6.9.1 (stable) or 6.10.0 (latest), with xo-server packages 5.211.2 and 5.213.1. The vulnerability was discovered by security researchers Filip Magic and Christoffer Olsen of TDC NET Security.
The response
Vates has released patched versions to fix the vulnerability. Administrators are urged to update Xen Orchestra immediately. If updating is not possible, Vates recommends restricting access to Xen Orchestra to dedicated management networks and blocking known malicious IP addresses.
The company has also shared indicators of compromise (IOCs) to help administrators spot attacks. These include connections to specific IP addresses and .onion domains, suspicious authentication cookies (such as authenticationToken=j:{}), modified VM configurations (with hvm_serial: file), and unusual files like /etc/cron.d/zz-ustar and /.ustar5.
Vates warns that exploitation does not leave clear traces in logs, so detection requires monitoring HTTP traffic for suspicious activity. If compromise is suspected, administrators should rotate all passwords and secrets used by their virtualisation environments.
What you should do
- Update Xen Orchestra to the latest version as soon as possible.
- Restrict access to the management interface to trusted networks.
- Monitor for the provided IOCs.
- Rotate credentials if compromise is suspected.
This report is based on a single source (BleepingComputer (opens in a new tab)). The vendor has confirmed exploitation, but no primary source or government advisory has been published yet.
Why it matters
This flaw gives attackers full control over virtualisation servers, which could lead to data theft or disruption of critical systems. Many organisations rely on Xen Orchestra to manage their infrastructure, making quick patching essential.
Key points
- A critical flaw in Xen Orchestra lets attackers bypass authentication.
- Attackers can gain admin rights and take over XCP-ng servers.
- Vates has released patches and shared indicators of compromise.
- Exploitation does not leave clear log traces; HTTP monitoring is needed.
- Immediate patching and credential rotation are advised.
Sources
BleepingComputer
Reference
