VMware Patches Authentication bypass bugs

VMware has fixed a vulnerability that affects multiple products with a critical authentication bypass vulnerability that can allow an attacker to gain administrative access to a system as well as exploit other flaws.

The bug tracked as CVE-2022-31656 earned a rating of 9.8 on the CVSS and is one of several fixes the company made in various that could easily become an exploit chain.

An authentication bypass vulnerability affecting VMware Workspace ONE Access, Identity Manager, and vRealize Automation that affects local domain users and requires that a remote attacker must have network access to a vulnerable user interface. Once an attacker achieves this, he or she can use the flaw to bypass authentication and gain administrative access, she said.

The vulnerability is the gateway to exploiting other RCE flaws addressed by VMWare’s release this week CVE-2022-31658 and CVE-2022-31659 to form an attack chain.

CVE-2022-31658 with a CVSS of 8.0 is a JDBC injection RCE vulnerability that affect VMware Workspace ONE Access, Identity Manager, and vRealize Automation The flaw allows a malicious actor with administrator and network access to trigger RCE.

CVE-2022-31659 with the same CVSS of 8.0 is an SQL injection RCE vulnerability that affects VMware Workspace ONE Access and Identity.

The other six bugs patched in the update includes the below vulnerabilities

• RCE bug tracked as CVE-2022-31665 rated as important.
• Two privilege escalation vulnerabilities tracked as CVE-2022-31660 and CVE-2022-31661 rated as important.
• A local privilege escalation vulnerability tracked as CVE-2022-31664 was rated as important.
• A URL Injection Vulnerability tracked as CVE-2022-31657 rated as moderate.
• A path traversal vulnerability tracked as CVE-2022-31662 rated as moderate.

Even patching has still not been enough for VMware, with attackers targeting existing flaws after the company does its due diligence to release a fix.