CVE-2022-22960
VMware Multiple Products Privilege Escalation Vulnerability
Description
CVE-2022-22960 is a privilege escalation vulnerability affecting VMware Workspace ONE Access, VMware Identity Manager, and VMware vRealize Automation, caused by improper permissions in support scripts. This vulnerability allows a local attacker with initial access to escalate their privileges to root on the affected VMware products. The improper permission configuration in support scripts creates an exploitable condition where low-privileged users can gain full administrative control over the VMware infrastructure. CISA has added CVE-2022-22960 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 6, 2022. The EPSS percentile of approximately 99% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud foundation | >= 3.0, < 5.0 |
| vmware | identity manager | 3.3.3; 3.3.4; 3.3.5; 3.3.6 |
| vmware | vrealize automation | 7.6 |
| vmware | vrealize suite lifecycle manager | >= 8.0, < 9.0 |
| vmware | workspace one access | 20.10.0.0; 20.10.0.1; 21.08.0.0; 21.08.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/171935/VMware-Workspace-ONE-Access-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.vmware.com/security/advisories/VMSA-2022-0011.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22960(US Government Resource)
Weakness Type
CWE-276: Incorrect Default Permissions
The privilege escalation in VMware products stems from incorrect default permissions assigned to support scripts. In CVE-2022-22960, certain support or diagnostic scripts within VMware Workspace ONE Access, Identity Manager, and vRealize Automation are configured with overly permissive file permissions, allowing a local attacker to modify or execute these scripts to gain root-level access on the underlying system.
Learn more: CWE-276 — Incorrect Default Permissions
Impact Analysis
CVE-2022-22960 requires local access to the affected VMware system, but once this access is obtained, the attacker can exploit the improper permissions in support scripts to escalate to root privileges. This vulnerability is particularly dangerous because it is commonly chained with remote code execution vulnerabilities such as CVE-2022-22954 (a server-side template injection in the same VMware products) to achieve unauthenticated remote root access. The impact on confidentiality is severe, as root access exposes all data managed by the VMware identity and access management infrastructure, including authentication tokens, user credentials, and federation configurations. The integrity of the entire identity management platform is compromised, and the availability of all services depending on VMware Workspace ONE Access or Identity Manager can be disrupted. The EPSS percentile of approximately 99% indicates near-certain exploitation, confirming that this vulnerability is a key component in active attack chains targeting VMware infrastructure.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-22960 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 6, 2022. The EPSS percentile of approximately 99% indicates near-certain exploitation activity. CVE-2022-22960 is frequently chained with CVE-2022-22954, a server-side template injection vulnerability in the same VMware products, creating an unauthenticated remote root access chain that has been widely exploited by threat actors. The combination of these two vulnerabilities provides a complete attack path from remote unauthenticated access to full root control, making this a high-priority threat for any organization running affected VMware products.
Remediation
-
Apply VMware security updates immediately as directed by CISA: "Apply updates per vendor instructions." Install the VMware patches for Workspace ONE Access, Identity Manager, and vRealize Automation that address the improper permissions in support scripts.
-
Apply patches for CVE-2022-22954 concurrently as these vulnerabilities are commonly chained together. Ensure both the privilege escalation (CVE-2022-22960) and server-side template injection (CVE-2022-22954) patches are applied to fully close the attack chain.
-
Restrict access to VMware management interfaces by placing Workspace ONE Access, Identity Manager, and vRealize Automation behind network segmentation controls. Limit management access to trusted administrator networks only and implement multi-factor authentication for all administrative access.
-
Audit support script permissions on all VMware products to verify that the improper permissions have been corrected by the patch. Check for unauthorized modifications to support scripts and review file integrity monitoring logs for any changes to these scripts that may indicate prior exploitation.
-
Monitor for indicators of compromise by reviewing VMware application logs for signs of privilege escalation, checking for unauthorized root access, inspecting running processes for unexpected activity, and looking for web shells or backdoors that may have been installed through the chained exploitation of CVE-2022-22954 and CVE-2022-22960.
Technical Details
CVE-2022-22960 is a privilege escalation vulnerability caused by incorrect default permissions (CWE-276) in support scripts within VMware Workspace ONE Access, VMware Identity Manager, and VMware vRealize Automation. The vulnerability exists because certain support or diagnostic scripts that are executed with elevated privileges have overly permissive file permissions, allowing a local user to modify or replace these scripts and have their code executed with root privileges when the scripts are triggered. The local attack vector means this vulnerability alone cannot be exploited remotely, but it is consistently chained with CVE-2022-22954, a server-side template injection vulnerability in the same products, which provides the initial remote code execution as a low-privileged user. The combination creates a full unauthenticated remote-to-root exploit chain that has been widely weaponized against VMware identity infrastructure deployments.
Frequently Asked Questions
Is CVE-2022-22960 being actively exploited?
Yes, CVE-2022-22960 is being actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 6, 2022. It is commonly chained with CVE-2022-22954 to achieve unauthenticated remote root access on VMware systems.
What products are affected by CVE-2022-22960?
CVE-2022-22960 affects VMware Workspace ONE Access, VMware Identity Manager, and VMware vRealize Automation. These products are critical identity and access management infrastructure components used in enterprise environments.
How do I fix CVE-2022-22960?
Apply VMware security updates for Workspace ONE Access, Identity Manager, and vRealize Automation. Ensure patches for both CVE-2022-22960 and CVE-2022-22954 are applied to close the full attack chain. Restrict access to management interfaces and audit support script permissions.
How severe is CVE-2022-22960?
CVE-2022-22960 is a critical vulnerability with an EPSS percentile of approximately 99%. While it requires local access alone, it is consistently chained with remote code execution vulnerabilities to provide unauthenticated root access to VMware identity infrastructure, making it a top-priority remediation target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.