One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 4790513 |
| Date de publication | 2022-05-24 13:31:05 (vue: 2022-05-24 21:06:34) |
| Titre | CISA Warns VMware Vulnerabilities Exploited in the Wild Leading to Full System Compromise |
| Texte | FortiGuard Labs is aware that the Cybersecurity and Infrastructure Security Agency (CISA) CISA released an advisory on recently patched VMware vulnerabilities (CVE-2022-22954 and CVE-2022-22960) being exploited separately and in combination, allowing threat actors to gain full control of the compromised system. Both vulnerabilities affect VMware Workspace ONE Access, Identity Manager, and vRealize Automation and were patched on April 6th, 2022. The advisory also states that CISA expects threat actors to develop exploits for newly patched VMware vulnerabilities (CVE-2022-22972 and CVE-2022-22973) quickly.Why is this Significant?This is significant because the advisory that CISA released on CVE-2022-22954 and CVE-2022-22960 was prompted by an actual incident which one large organization was compromised by an unidentified threat actor on or around April 12, 2022. According to the advisory, the threat actor "leveraged CVE-2022-22954 to execute an arbitrary shell command as a VMware user. The actor then exploited CVE-2022-22960 to escalate the user's privileges to root. With root access, the actor could wipe logs, escalate permissions, and move laterally to other systems". The advisory also warns that exploits for another VMware vulnerabilities (CVE-2022-22972 and CVE-2022-22973) will be developed soon. As such, the patches for the four vulnerabilities or workarounds should be applied as soon as possible.What is CVE-2022-22954, CVE-2022-22960, CVE-2022-22972 and CVE-2022-22973?CVE-2022-22954 is a vulnerability in VMware Workspace ONE Access, Identity Manager, and vRealize Automation, which an attacker with network access can trigger a server-side template injection that may result in remote code execution. The vulnerability has the CVSSv3 base score of 9.8 and is rated critical.FortiGuard Labs previously released Threat Signal on CVE-2022-22954. See Appendix for a link to "Newly Patched VMware Vulnerability (CVE-2022-22954) Being Exploited in the Wild".CVE-2022-22960 is a Local Privilege Escalation (LPE) vulnerability in VMware Workspace ONE Access, Identity Manager, and vRealize Automation. As LPE, attacker is required to have local access can escalate privileges to 'root'. The vulnerability has the CVSSv3 base score of 7.8 and is rated important.CVE-2022-22972 is an authentication bypass vulnerability that affects VMware Workspace ONE Access, Identity Manager and vRealize Automation. As LPE, exploitation happens locally as such an attacker is required to have access to the victim's machine to elevate privileges. The vulnerability has the CVSSv3 base score of 9.8 and is rated critical.CVE-2022-22973 is a Local Privilege Escalation (LPE) vulnerability that affects VMware Workspace ONE Access, Identity Manager and vRealize Automation. As LPE, attacker is required to have local access can escalate privileges to 'root'. The vulnerability has the CVSSv3 base score of 7.8 and is rated important.Has the Vendor Released Advisories?Yes, VMware released advisories for all four vulnerabilities. See the Appendix for links to "VMSA-2022-0011.1" and "VMSA-2022-0014".Has the Vendor Released Patches for the Vulnerabilities?VMware released patches for CVE-2022-22954 and CVE-2022-22960 on April 6th, 2022. Patches for CVE-2022-22972 and CVE-2022-22973 were released on May 18th, 2022. What is the Status of Coverage?FortiGuard Labs has released the following IPS signature for CVE-2022-22954:VMware.Workspace.ONE.Access.Catalog.Remote.Code.ExecutionA network IOC for CVE-2022-22954 called out in the CISA advisory is blocked by the WebFiltering client.CVE-2022-22960, CVE-2022-22972, CVE-2022-22973 were privately disclosed as such there currently is no available Proof-of-Concept code. FortiGuard Labs is monitoring the situation closely and will update this Threat Signal when protection becomes available.Any Suggested Mitigation?VMware has provided mitigations for CVE-2022-22954, CVE-2022-22960, CVE-2022-22972. See the Appendix for links to "KB88098" for CVE-2022-22954 and CVE-2022-22960, and "KB88433" for CVE-2022-22972. |
| Envoyé | Oui |
| Condensat | 0011 0014 18th 2022 22954 22954:vmware 22960 22972 22973 6th access according actor actors actual advisories advisory affect affects agency all allowing also another any appendix applied april arbitrary around attacker authentication automation available aware base because becomes being blocked both bypass called can catalog cisa client closely code combination command compromise compromised concept control could coverage critical currently cve cvssv3 cybersecurity develop developed disclosed elevate escalate escalation execute execution executiona expects exploitation exploited exploits following fortiguard four full gain happens has have identity important incident infrastructure injection ioc ips kb88098 kb88433 labs large laterally leading leveraged link links local locally logs lpe machine manager may mitigation mitigations monitoring move network newly one organization other out patched patches permissions possible previously privately privilege privileges prompted proof protection provided quickly rated recently released remote required result root score security see separately server shell should side signal signature significant situation soon states status such suggested system systems template then threat trigger unidentified update user vendor victim vmsa vmware vrealize vulnerabilities vulnerability warns webfiltering what when which why wild will wipe workarounds workspace |
| Tags | Vulnerability Threat |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.