Post #552 42 May 21, 2019, 13:26 UTC RCE VMware Fusion 11https://theevilbit.github.io/posts/vmware_fusion_11_guest_vm_rce_cve-2019-5514/ theevilbit.github.io CVE-2019-5514 - VMware Fusion 11 - Guest VM RCE TL;DR Link to heading You can run an arbitrary command on a VMware Fusion guest VM through a website without any priory knowledge. Basically VMware Fusion is starting up a websocket listening only on the localhost. You can fully control all the VMs (also…