CVE-2023-20887 Leads to RCE in VMware Aria Operations for Networks

This report documents CVE-2023-20887, a critical (CVSS 9.8) remote command injection in VMware Aria Operations (vRealize Network Insight) affecting version 6.x and above; it explains how an attacker can inject commands via the createSupportBundle/nodeId parameter, how an nginx rewrite trick (adding a dot in the path) can bypass access restrictions to reach the vulnerable endpoint, notes a public PoC on GitHub, and recommends applying VMware's patch and using the provided YARA network detection rule.