CVE-2022-22960

VMware Multiple Products — VMware Multiple Products Privilege Escalation Vulnerability

Description

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2022-22960 is a local privilege escalation with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and an EPSS score in the 98.4th percentile, indicating that exploit code is widely available and actively used. The vulnerability is especially critical in environments where Workspace ONE Access or Identity Manager serves as the central identity provider for hybrid cloud infrastructure: an attacker who has already obtained low-privileged access — for example via CVE-2022-22954, an RCE flaw addressed in the same advisory — can chain CVE-2022-22960 to gain immediate root access and fully compromise the IAM trust anchor. NIS2-scoped organisations running VMware-based identity infrastructure should treat this as P1 regardless of the absence of a confirmed ransomware campaign flag: the combination of near-top-percentile EPSS and the central role these systems play in authentication chains makes immediate remediation non-negotiable.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply VMware security patch immediately: VMSA-2022-0011 addresses CVE-2022-22960 across Workspace ONE Access, Identity Manager, and vRealize Automation — verify exact build numbers in the vendor advisory VMSA-2022-0011 against your installed versions before deploying.
  • Patch Cloud Foundation (versions 3.x–5.x) and vRealize Suite Lifecycle Manager (8.x–9.x) as well — both product lines are in scope; VMware provides separate patch bundles via SDDC Manager.
  • Immediately audit local accounts on affected appliances: check whether non-privileged service accounts (e.g. horizon, hzncloud, wsntp) have been escalated to root since the patch became available.
  • Restrict SSH access to affected appliances to dedicated jump hosts and disable interactive logins for all non-administrative accounts until the patch is applied.
  • Rotate passwords for all local accounts on affected appliances — especially admin, root, and any service accounts with access to support scripts.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Limit access to management interfaces (typically TCP 443, 8443, 22) of affected appliances to a dedicated management VLAN; block outbound connections from appliances to the internet.
  • Least-privilege / IAM: Review and tighten sudo rules on appliances — specifically /etc/sudoers.d/ entries granting unrestricted rights to service accounts; remove or minimise NOPASSWD entries.
  • Filesystem hardening: Manually set permissions on support scripts under /opt/vmware/ and /usr/local/horizon/ to root:root 0750 or more restrictive if the patch cannot be applied immediately — document changes, as updates may overwrite them.
  • IDS/IPS rule: Monitor for anomalous SSH sessions originating from appliance IPs to internal systems at the network layer — a strong lateral-movement indicator following a successful escalation.
  • Privileged Access Workstation (PAW): Enforce administrative access to affected systems exclusively via hardened PAW hosts with MFA.

Runbook · Step 3

Detection rules

  • Linux auditd: Set a rule on execve syscalls where uid!=0 and euid=0 on affected appliances — escalation to root without a legitimate sudo call is a strong indicator: auditctl -a always,exit -F arch=b64 -S execve -F uid!=0 -F euid=0 -k priv_esc_cve22960
  • Syslog / auth.log: Monitor for patterns sudo:.*COMMAND=.*support.* or su.*root in /var/log/auth.log on appliances for unexpected service accounts; SPL snippet: source="/var/log/auth.log" ("sudo" OR "su") "root" NOT user IN ("admin","root")
  • File Integrity Monitoring (FIM): Alert on writes to scripts under /opt/vmware/scripts/, /usr/local/horizon/scripts/, and /etc/sudoers.d/; SIEM rule shape: file_path MATCHES "/opt/vmware/scripts/*" AND event_type="WRITE" AND actor_uid!="0"
  • EDR / process ancestry: Flag process chains support_script.sh → bash → id/whoami/passwd or similar reconnaissance commands running with euid=0 on appliance hosts as high-severity alerts.
  • Sigma rule shape: title: VMware Support Script Privilege Escalation | logsource: product: linux | detection: selection: exe|contains: ['/opt/vmware', '/usr/local/horizon'] AND euid: 0 AND uid|not: 0 | condition: selection

Metrics

Severity
critical
Actively exploited
actively exploited (KEV)
7.8
Source: nvd-v3
98.4 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
35.8 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2022-04-15 00:00 UTC

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • vmware

    cloud_foundation3.0 – 5.0

  • vmware

    identity_manager

  • vmware

    vrealize_automation

  • vmware

    vrealize_suite_lifecycle_manager8.0 – 9.0

  • vmware

    workspace_one_access

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2022-22960