CVE-2022-22948
VMware vCenter Server Incorrect Default File Permissions Vulnerability
Description
CVE-2022-22948 is a medium-severity information disclosure vulnerability in VMware vCenter Server caused by improper file permissions. The flaw allows a malicious actor with non-administrative access to the vCenter Server to exploit insecure file permissions and gain access to sensitive information. With a CVSS v3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this vulnerability affects vCenter Server versions 6.5, 6.7, and 7.0, as well as VMware Cloud Foundation versions 3.x and 4.x. It has been added to CISA's KEV catalog with a remediation deadline of August 7, 2024, and carries an EPSS score of 0.26504 (96.2th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud foundation | >= 3.0, < 3.11; >= 4.0, < 4.4.1 |
| vmware | vcenter server | 6.5; 6.7; 7.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://www.vmware.com/security/advisories/VMSA-2022-0009.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22948(US Government Resource)
Weakness Type
Improper File Permission Assignment
CVE-2022-22948 stems from improper permission assignment on files within the vCenter Server environment. The platform stores sensitive configuration and credential data in files that are accessible to users with lower privilege levels than intended. When file permissions are set too permissively, authenticated users who should not have access to sensitive system information can read these files, exposing credentials, configuration details, and other sensitive data that could be used to escalate privileges or move laterally within the virtualization infrastructure. This class of vulnerability is particularly dangerous in enterprise virtualization environments where vCenter Server manages access to the entire virtual infrastructure.
Impact Analysis
Sensitive Information Exposure in Virtualization Infrastructure is the primary business risk of CVE-2022-22948. VMware vCenter Server is the centralized management platform for VMware virtualized environments, and information disclosed through this vulnerability can have cascading security consequences.
Confidentiality Impact is maximum (C:H). A low-privileged authenticated user can access sensitive files that may contain database credentials, encryption keys, service account passwords, and configuration data for the entire vCenter Server deployment. This information can reveal the structure of the virtual infrastructure, connected ESXi hosts, storage configurations, and potentially credentials that grant access to virtual machines and their data.
Integrity Impact is none (I:N). The vulnerability only allows reading files; it does not enable direct modification of system files or configurations. However, the information obtained can be used to facilitate integrity-impacting attacks through privilege escalation or lateral movement.
Availability Impact is none (A:N). The vulnerability does not directly affect system availability. The information disclosure itself does not disrupt services, though subsequent attacks using the disclosed information could lead to availability impacts.
Strategic Exploitation Value: The information disclosed through CVE-2022-22948 is particularly valuable because vCenter Server is the control plane for VMware environments. Credentials and configuration data from vCenter can enable an attacker to compromise the entire virtual infrastructure, including all virtual machines, virtual networks, and storage. The EPSS score of 0.26504 (96.2th percentile) and CISA's KEV listing confirm active exploitation. CISA lists the ransomware association as "Unknown," though vCenter compromise is a known precursor to ransomware attacks targeting virtualized environments.
Exploit Maturity
CVE-2022-22948 is confirmed as actively exploited in the wild, as documented by its listing in CISA's KEV catalog with a remediation deadline of August 7, 2024. The EPSS score of 0.26504 (96.2th percentile) confirms significant exploitation activity.
Post-Authentication Exploitation: While the vulnerability requires low-privilege authentication (PR:L), many vCenter environments have multiple users with various access levels, including read-only administrators, auditors, and service accounts. Compromise of any of these low-privilege accounts provides sufficient access to exploit this vulnerability and extract sensitive information.
Attack Chain Component: CVE-2022-22948 is frequently used as part of multi-stage attack chains targeting VMware environments. Attackers who gain initial low-privilege access to vCenter through phishing, credential stuffing, or other means use this vulnerability to extract credentials that enable escalation to full administrative control over the virtual infrastructure.
Vendor Advisory: VMware published a security advisory (VMSA-2022-0009) addressing this vulnerability along with patches for affected versions.
Ransomware Association: CISA lists the ransomware status as "Unknown." However, VMware vCenter compromise has been a documented step in multiple ransomware campaigns, where attackers escalate from vCenter access to deploying ransomware across all virtual machines in the environment.
Remediation
-
Apply the VMware security patches referenced in VMSA-2022-0009. Update vCenter Server 6.5, 6.7, and 7.0 to the patched versions specified in the advisory. For VMware Cloud Foundation versions 3.x and 4.x, apply the corresponding updates through the Cloud Foundation lifecycle management process.
-
Review and correct file permissions on the vCenter Server appliance. Audit file permissions on configuration files, credential stores, and sensitive data directories to ensure they are restricted to the minimum required access levels. Pay particular attention to files that may contain database connection strings, encryption keys, or service account credentials.
-
Audit existing vCenter user accounts and reduce privileges to the minimum necessary. Review all accounts with any level of access to vCenter Server and remove unnecessary permissions. Disable or delete dormant accounts, service accounts that are no longer needed, and any accounts with overly broad access that could be used to exploit this vulnerability.
-
Monitor for indicators of compromise by reviewing vCenter Server access logs for unusual file access patterns from low-privilege accounts. Look for read operations on sensitive configuration files, credential files, or system directories that would not be part of normal administrative activity. Correlate with authentication logs to identify suspicious login activity.
-
Implement network segmentation to restrict access to the vCenter Server management interface. Place vCenter Server on a dedicated management network accessible only from authorized administrator workstations. Deploy firewall rules that prevent general users from directly accessing the vCenter Server, even if they have authenticated credentials.
Technical Details
CVE-2022-22948 is an information disclosure vulnerability in VMware vCenter Server caused by improper file permission settings that allow low-privilege users to access sensitive system files.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N produces a base score of 6.5. The network attack vector (AV:N) indicates remote exploitability through the vCenter management interface. Low attack complexity (AC:L) means no special conditions are needed beyond authentication. Low privileges are required (PR:L), meaning the attacker needs at least a basic authenticated session. No user interaction (UI:N) is needed. The scope is unchanged (S:U), confidentiality impact is high (C:H) reflecting exposure of sensitive data, while integrity (I:N) and availability (A:N) are unaffected.
Vulnerability Mechanism: The vCenter Server stores sensitive configuration and credential information in files on the appliance filesystem. These files are assigned permissions that are more permissive than necessary, allowing users with low-privilege access to the vCenter system to read them. The sensitive data exposed may include PostgreSQL database credentials used by the vCenter Server Appliance, encryption keys, LDAP bind credentials, and other service account passwords stored in configuration files.
Affected Scope: The vulnerability affects vCenter Server versions 6.5, 6.7, and 7.0, spanning several years of releases. VMware Cloud Foundation versions 3.x (before 3.11) and 4.x (before 4.4.1) are also affected, as they bundle vCenter Server as a core component. This broad version range means a significant portion of VMware deployments were vulnerable.
Privilege Escalation Path: While classified as an information disclosure vulnerability, the practical impact extends beyond simple data exposure. Credentials obtained through this vulnerability can be used to authenticate to other services within the vCenter ecosystem, potentially including the vCenter database, ESXi hosts, or external directory services. This makes CVE-2022-22948 a stepping stone to full infrastructure compromise rather than an isolated information disclosure issue.
Frequently Asked Questions
What is CVE-2022-22948?
CVE-2022-22948 is an information disclosure vulnerability in VMware vCenter Server caused by improper file permissions. It allows authenticated users with low-level access to read sensitive files containing credentials and configuration data that should be restricted to administrators only.
What information can be disclosed through CVE-2022-22948?
The vulnerability can expose sensitive data including database credentials, service account passwords, encryption keys, and configuration details stored on the vCenter Server appliance. This information can be used for privilege escalation and lateral movement within the VMware infrastructure.
Does CVE-2022-22948 require authentication to exploit?
Yes, the vulnerability requires low-privilege authentication (PR:L). An attacker needs at least a basic authenticated session on the vCenter Server. However, many environments have multiple users with various access levels, and compromise of any low-privilege account provides sufficient access to exploit this vulnerability.
How does CVE-2022-22948 relate to ransomware attacks on VMware environments?
While CISA lists the ransomware association as "Unknown," VMware vCenter compromise is a well-documented precursor to ransomware attacks targeting virtualized environments. Attackers who extract credentials through this vulnerability can escalate to full administrative control, enabling them to deploy ransomware across all virtual machines managed by the compromised vCenter instance.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.