Authentication Bypass in Nutanix Prism Element

Executive Summary

This vulnerability, dubbed Prism Auth Bypass, allows an unauthenticated remote attacker to bypass authentication in Nutanix Prism Element by sending a crafted HTTP header. The server then responds with a session cookie containing a JWT granting full administrative privileges. This enables the attacker to execute root-level commands on all Controller VMs in the cluster.

Useful 0 Not Useful 0

Detection Guidance

Detect this vulnerability by checking for unauthorized administrative API access attempts on port 9440. Monitor HTTP headers for crafted internal management headers and inspect for unexpected Set-Cookie responses containing JWT tokens. Review logs for unusual administrative commands or root-level activities on Controller VMs.

Useful 0 Not Useful 0

Impact Analysis

Exploitation could lead to complete cluster destruction, unauthorized access to VM memory and virtual disks, and full administrative control over the Nutanix environment. Attackers could gain root-level access and perform destructive actions across the entire cluster.

Useful 0 Not Useful 0

Mitigation Strategies

• Restrict access to the management interface (port 9440) to trusted administrative networks only.
• Upgrade affected Nutanix Prism Element and Prism Central to fixed versions (AOS 7.6.0.8, 7.5.2, 7.3.1.18 or later; Prism Central 7.6.0.8, 7.5.2, 7.3.1.18 or later).
• Verify deployed versions and confirm network exposure to ensure no unnecessary exposure exists.
• If unauthorized activity is suspected, restrict access immediately, preserve audit logs, and contact Nutanix Support.

Useful 0 Not Useful 0