An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.
The vulnerability affects Nutanix AOS versions running Prism Gateway, where the Prism Element management port (9440) is exposed directly to the public internet (or an open network) without a firewall to block malicious traffic.
Proof-of-concept exploitation was validated during responsible disclosure. No public exploit code or automated attack toolkits are currently known to be publicly distributed.
Organizations can mitigate this issue prior to patching by enforcing the following controls:
-
Network Segmentation: Restrict access to the Prism Element management port (9440) strictly to dedicated management VLANs, jump boxes or authorized IP ranges.
-
Ingress Traffic Filtering: Configure upstream Web Application Firewalls (WAFs) or ingress reverse proxies to strip specific internal management headers from incoming API requests before they reach the cluster.
Note on WAF Configuration workaround: Nutanix is willing to securely provide the exact header string via Support to verified existing customers who are temporarily unable to apply the patch.
Upgrade affected Nutanix AOS deployments to version 7.3.1.18, 7.5.2, 7.6.0.8 or later fixed releases.