This article examines the exploitation of a critical remote code execution (RCE) vulnerability in VMware Workspace ONE Access, resulting in the installation of malware. The vulnerability, known as CVE-2022-22954, was discovered by Morphisec and is part of a recent security update addressing three RCEs, including CVE-2022-22957 and CVE-2022-22958. Affected systems encompass VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation, and vRealize Suite Lifecycle Manager. VMware has confirmed the exploitation of CVE-2022-22954, which involves leveraging the vulnerability to gain initial network access, utilizing a public demonstration exploit for another RCE, executing a PowerShell command to launch a stager, and downloading an obfuscated PowerTrash loader from a command and control (C2) server to load a Core Impact agent into memory. Notably, Morphisec experts have obtained pertinent details, such as the C2 address, Core Impact client version, and encryption key used for C2 communication. The role of an internet hosting company supporting illicit websites and the involvement of Neculiti or related entities in cybercrime campaigns remain unresolved.
Key Takeaways
- Morphisec discovered a critical remote code execution (RCE) vulnerability in VMware Workspace ONE Access.
- The vulnerability, tracked as CVE-2022-22954, affects VMware Identity Manager, vRealize Automation, Cloud Foundation, and vRealize Suite Lifecycle Manager.
- There are two other RCE vulnerabilities, CVE-2022-22957 and CVE-2022-22958, which have also been addressed in a security update.
- Hackers have been actively exploiting these vulnerabilities, with confirmed exploits of CVE-2022-22954 by VMware.
Vulnerability Details
The vulnerability details of the critical remote code execution (RCE) in VMware Workspace ONE Access, tracked as CVE-2022-22954, were discovered by Morphisec, with two other RCEs, CVE-2022-22957 and CVE-2022-22958, also addressed in the security update. This highlights the increasing trend of hackers exploiting VMware vulnerabilities. To protect against RCE vulnerabilities in VMware Workspace ONE Access, organizations can implement mitigation strategies such as keeping software up to date with the latest security patches, using strong authentication mechanisms, and restricting access to sensitive systems. Responsible disclosure plays a crucial role in addressing and mitigating RCE vulnerabilities in software systems. It involves security researchers responsibly reporting vulnerabilities to the vendor, allowing them to develop and release patches, thereby protecting users from potential exploitation.
Exploit Impact
The exploitation of the vulnerability in VMware Workspace ONE Access has resulted in significant consequences for affected systems and networks. To mitigate the impact of Remote Code Execution (RCE) vulnerabilities in VMware systems, organizations should implement the following strategies:
-
Regularly update and patch VMware software: Keeping the software up to date with the latest security patches is crucial to address any known vulnerabilities.
-
Implement network segmentation: By segregating the network into different segments, organizations can limit the potential spread of malware and minimize the impact of an RCE attack.
-
Use intrusion detection and prevention systems: Deploying these systems can help detect and block any malicious activities attempting to exploit RCE vulnerabilities.
-
Practice responsible disclosure: Vendors should work closely with security researchers and encourage responsible disclosure of vulnerabilities. This allows for timely patching and reduces the window of opportunity for hackers to exploit these vulnerabilities.
By implementing these mitigation strategies and promoting responsible disclosure, organizations can better protect their VMware systems against RCE vulnerabilities and minimize the potential impact of such exploits.
Attack Chain
The attack chain utilized in the recent VMware vulnerability involves exploiting a specific vulnerability to gain initial network access, followed by the execution of remote code that allows the attacker to download and load malicious software into the compromised system’s memory. To protect against remote code execution (RCE) vulnerabilities in VMware, organizations can implement several mitigation strategies. First, keeping systems up to date with the latest security patches and updates is crucial. Additionally, organizations should implement strong access controls and restrict unnecessary privileges to limit the potential damage of an RCE attack. Employing robust network segmentation can also help prevent lateral movement within the network. Furthermore, leveraging threat intelligence can aid in identifying and preventing RCE attacks in VMware by providing insights into the latest attack techniques and indicators of compromise. Regular security awareness training for employees can also help in detecting and reporting potential threats.
Frequently Asked Questions
What is the specific nature of the RCE vulnerability in VMware Workspace ONE Access?
The specific nature of the RCE vulnerability in VMware Workspace ONE Access is that it allows remote attackers to execute arbitrary code on the affected system. This can potentially lead to unauthorized access and the installation of malware.
How are the other RCEs, CVE-2022-22957 and CVE-2022-22958, addressed in the security update?
The security update addresses CVE-2022-22957 and CVE-2022-22958 by providing mitigation measures. Organizations can ensure their VMware products are secure by applying the security update promptly and following best practices for system patching and vulnerability management.
Which other VMware products are affected by these vulnerabilities?
The vulnerabilities CVE-2022-22954, CVE-2022-22957, and CVE-2022-22958 in VMware Workspace ONE Access, vIDM, vRA, VMware Cloud Foundation, and vRealize Suite Lifecycle Manager have impacted the virtualization industry. VMware has taken steps to address these vulnerabilities through security updates.
Are there any known instances of hackers exploiting these vulnerabilities?
There have been known instances of hackers exploiting vulnerabilities in VMware products, including the recently discovered RCE vulnerabilities. These vulnerabilities have impacted organizations using VMware Workspace ONE Access, vIDM, vRA, VMware Cloud Foundation, and vRealize Suite Lifecycle Manager. To mitigate the risks, VMware has released security updates addressing these vulnerabilities. The impact on affected organizations could include unauthorized access to their systems, potential data breaches, and the installation of malware. It is important for organizations to promptly apply the security updates and follow best practices for securing their VMware environments. Examples of successful RCE exploits in other software systems, such as Microsoft Windows and Adobe products, highlight the seriousness of these vulnerabilities and the need for proactive security measures.
What actions can users take to protect themselves from these exploits?
To protect themselves from these exploits, users should prioritize user awareness and regularly update their software. User awareness involves educating individuals about the risks of cyber threats and the importance of practicing safe online behaviors. Additionally, software updates are crucial as they often include patches and security fixes that address known vulnerabilities. By staying informed and implementing these measures, users can enhance their protection against potential exploits.
