- VMware was privately notified that it is facing multiple vulnerabilities with a maximum CVSSv3 base score of 9.8.
- The vulnerabilities include a directory traversal vulnerability, a broken access control vulnerability, a deserialization vulnerability, and an information disclosure vulnerability.
- Vmware provides fixes to different versions of VMware vRealize Log Insight vulnerabilities which you can find below.
On the 24th of January, VMware announced that it was privately notified of several vulnerabilities in VMware vRealize Log Insight. According to VMware, the issue is of critical severity, with a maximum CVSSv3 base score of 9.8. A directory traversal vulnerability, a broken access control vulnerability, a deserialization vulnerability, and an information disclosure vulnerability are among the reported flaws.
Multiple vulnerabilities found
The first vulnerability is a directory traversal vulnerability tracked as CVE-2022-31706 with a CVSSv3 base score of 9.8. A directory traversal vulnerability is caused by insufficient validation of user browser input. If the attack is successful, the threat actor will be able to access restricted files and run commands on the server.
The second vulnerability is a broken access control vulnerability tracked as CVE-2022-31704 with a CVSSv3 base score of 9.8. A broken access control vulnerability could result in malicious actors injecting files into the operating system of an impacted device remotely.
The third vulnerability is a deserialization vulnerability tracked as CVE-2022-31710 with a CVSSv3 base score of 7.5. A deserialization vulnerability may result in an unauthenticated malicious actor remotely causing a denial of service.
The last vulnerability is an information disclosure vulnerability tracked as CVE-2022-31711 with a CVSSv3 base score of 5.3. This vulnerability can result in a malicious actor remotely collecting sensitive information without authentication.
Fixes for the vulnerabilities
VMware has released patches for the aforementioned vulnerabilities; updating VMware vRealize Log Insight and VMware Cloud Foundation components:
Click here for VMware vRealize Log Insight version 8.x fix details
Click here for VMware Cloud Foundation versions 4.x and 3.x fix details
Workaround
VMware has also provided a workaround for those issues for the system administrators who can’t apply the patches on their instances. Simply follow the steps below to apply the temporary fixes on the affected systems, for each vRealize Log Insight node
Step 1: Download the script
Download the script provided by VMware as a temporary solution for the issue by clicking here.
Step 2: Log into a node
Log into the node as root via SSH (using Putty.exe or any similar SSH Client)
Step 3: Upload the script
Upload the KB90635.sh script into the /opt/vmware/bin/ folder using WinSCP or a similar utility
Step 4: Change permissions
Change the permissions of the file and make it executable by running the commands below:
chmod +x /opt/vmware/bin/KB90635.sh
chmod 755 /opt/vmware/bin/KB90635.shStep 5: Execute the script
Execute the script passing the “setup” argument:
/opt/vmware/bin/KB90635.sh setupStep 6: Repeat this for each node
Proceed to the next node in the cluster and follow steps 2-5 on each appliance