Moderate
CVE-2022-31660
CVE-2022-31660
Description
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to ‘root’.
Add Assessment
Technical Analysis
The VMware Workspace ONE Access, Identity Manager, and vRealize Automation products contain a locally exploitable vulnerability whereby the under-privileged horizon user can escalate their permissions to those of the root user. Notably, the horizon user runs the externally accessible web application. This means that remote code execution (RCE) within that component could be chained with this vulnerability to obtain remote code execution as the root user.
The vulnerability is due to the fact that the permissions on the file /opt/vmware/certproxy/bin/cert-proxy.sh are such that the horizon user is both the owner and has access to invoke this file.
To demonstrate and exploit this vulnerability, that file is overwritten, and then the following command is executed as the horizon user:
sudo /usr/local/horizon/scripts/certproxyService.sh restart
Note, that depending on the patch level of the system, the certproxyService.sh script may be located at an alternative path and require a slightly different command:
sudo /opt/vmware/certproxy/bin/certproxyService.sh restart
In both cases, the horizon user is able to invoke the certproxyService.sh script from sudo without a password. This can be verified by executing sudo -n --list. The certproxyService.sh script invokes the systemctl command to restart the service based on its configuration file. The service configuration file, located at /run/systemd/generator.late/vmware-certproxy.service, dispatches to /etc/rc.d/init.d/vmware-certproxy through the ExecStart and ExecStop directives, which in turn executes /opt/vmware/certproxy/bin/cert-proxy.sh.
The horizon user should not be the owner of or have write access to any executable files that run as root.
See the original disclosure for more information. This vulnerability has a public exploit in the form of a Metasploit module.
CVSS V3 Severity and Metrics
General Information
Vendors
- vmware
Products
- access connector 21.08.0.0,
- access connector 21.08.0.1,
- access connector 22.05,
- identity manager 3.3.4,
- identity manager 3.3.5,
- identity manager 3.3.6,
- identity manager connector 19.03.0.1,
- identity manager connector 3.3.4,
- identity manager connector 3.3.5,
- identity manager connector 3.3.6,
- one access 21.08.0.0,
- one access 21.08.0.1
Metasploit Modules
References
