- vCenter Server has a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.
- Malicious actors with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.
- VMware has categorized this bug to be in the Important vulnerability range. Product patch for vCenter Server contains VMware software, security, and third-party product fixes.
VMware has finally released a patch for one of the severities that affected its vCenter Server versions. These severities had been disclosed and reported by CrowdStrike’s Yaron Zinar and Sagi Sheinfeld in November 2021. According to the reported severities, the vCenter Server has a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.
VMware vCenter Server 7.0 update
Malicious actors with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group. VMware has categorized this bug to be in the Important vulnerability range. Classes of Vulnerabilities in VMware Products published by VMware explain it as exploitation results in the complete compromise of confidentiality and/or integrity of user data and/or processing resources through user assistance or by authenticated attackers.
However, NIST NVD’s CVE-2021-22048 entry gave the base Score of 8.8 – HIGH. Product patch for vCenter Server contains VMware software, security, and third-party product fixes. To download this patch, customers are provided download and installation instructions on the release page.
Last year, VMware also published instructions for the related bugs providing a workaround. VMware advises two options that admins should take into consideration to block the threats. The options are to switch to Active Directory over LDAPs authentication OR Identity Provider Federation for AD FS (vSphere 7.0 only).
The company declared on the webpage that Active Directory over LDAP authentication was not impacted by this vulnerability. However, they strongly recommended that customers should plan to move to another authentication method.