Attackers are exploiting a critical flaw in Xen Orchestra, the web-based management console for the XCP-ng virtualization platform, that lets an empty token pass its login check, according to an advisory Vates published on Nov. 10.
Vates said a successful attack gives the intruder admin privileges over the console. From there, it warned, attackers can run arbitrary code on managed pools and take over XCP-ng hosts as root.
The company rated the flaw critical but listed no CVSS score or CVE at the time of writing. It said the attacker initially operated from one IP address and a Tor hidden service, and credited the discovery to Filip Magic and Christoffer Olsen of TDC NET Security.
How the Empty Token Gets Through
The flaw lies in how Xen Orchestra’s REST interface reads its authentication cookie. A malformed cookie is turned into an empty object and passed on without any check that it is a real token. The token lookup treats the empty object as having no filter and returns the first stored token. If that token has not expired, the request is authenticated as its owner.
Vates said a successful exploit leaves no log of the unauthenticated access. Monitoring HTTP traffic for the empty-token pattern is the way to spot it.
The indicators from this campaign include a running VM named pivot2, VMs using an hvm_serial: file setting, cron and hidden files with “ustar” in their names on XCP-ng hosts, and /etc/ld.so.preload.
Vates cautioned that these cover only the campaign identified so far, and that their absence “is not sufficient to conclude that no compromise has occurred.”
Vates Advised Taking the Console Off the Internet
The company advised administrators not to expose Xen Orchestra to the internet and to place it on a dedicated management network. Exposed admin interfaces are a recurring target: earlier this month, researchers documented attackers exploiting AI servers left online without authentication.
Vates also urged updating as soon as possible. Versions before 6.9.2 on the stable channel and 6.10.1 on the latest channel are affected, along with the Xen Orchestra Appliance. The company further recommended blocking the eight attacker IP addresses it listed and Tor traffic.
Because configuration theft and credential harvesting cannot be ruled out, Vates advised administrators of compromised systems to rotate every password and secret, from backup storage credentials to the root account, pool secret and OTP secrets.
For a confirmed compromise, it recommended a full reinstallation, since cleanup alone “cannot guarantee the removal of all backdoors.”
