Vates VMS Xen Orchestra auth bypass exploited to hijack XCP-ng virtualization hosts

What happened

Vates VMS has reported a critical flaw in Xen Orchestra that allows remote attackers to bypass authentication via specially crafted REST cookies. By sending a cookie containing an empty JSON object, such as authenticationToken=j:%7B%7D, an attacker can trick the system into returning an existing, unexpired token and logging them in as that token's owner.

This vulnerability is currently being exploited by a threat actor using the IP 91.211.251.112:8001 and the Tor domain ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333. Successful exploitation grants Admin privileges, which can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root.

Why it matters

This is a high-impact vulnerability because it targets the management layer of your virtualization infrastructure. An attacker who bypasses authentication does not just gain access to a single VM; they can seize control of the entire XCP-ng host. Because the exploit involves hijacking existing tokens through cookie parsing, it allows for a silent takeover that may not leave traditional authentication logs.

Who is affected

• Xen Orchestra before 6.9.2 (stable)
• Xen Orchestra before 6.10.1 (latest)
• Xen Orchestra Appliance

What to do now

1. Update to Xen Orchestra 6.9.2 (stable) or 6.10.1 (latest) immediately.
2. Restrict Xen Orchestra access to a dedicated management network and ensure it is not exposed to the internet.
3. Block the IP 91.211.251.112 and the Tor domain ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333.
4. Hunt for a running virtual machine named pivot2 and check for files named /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, or /.ustar6.
5. If compromise is suspected, rotate all passwords and secrets, including proxy credentials, backup remotes (NFS, S3, Azure, SMB), root accounts, and pool secrets.

What we don't know yet

• The exact date when the exploitation activity began.
• Whether this vulnerability was initially exploited as a zero-day.
• The total number of victims affected by this campaign.