VMware vRealize Log Insight - Improper Access Control to RCE

criticalseverity

9.8CVSS score

81%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.

Impact

Successful exploitation allows a remote, unauthenticated attacker to inject and execute malicious code on the target appliance, potentially resulting in complete compromise of the affected system.

Fix

Update VMware vRealize Log Insight to version 8.10.2 or later, as detailed in the official vendor advisory.

How to confirm it

Send: GET {{BaseURL}}/i18n/component/JS?locale=en-US ; GET {{BaseURL}}/api/v1/version
Positive when: status_code == 200 and contains_any(body, "logInsight", "releaseName\":") AND compare_versions(version, '>= 3.0', '< 4.8') or compare_versions(version, '>= 8.0.0', '< 8.10.2')

Run it with nuclei: nuclei -id CVE-2022-31704 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-31704

info:
  name: VMware vRealize Log Insight - Improper Access Control to RCE
  author: ritikchaddha
  severity: critical
  description: |
    The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.
  impact: |
    Successful exploitation allows a remote, unauthenticated attacker to inject and execute malicious code on the target appliance, potentially resulting in complete compromise of the affected system.
  remediation: |
    Update VMware vRealize Log Insight to version 8.10.2 or later, as detailed in the official vendor advisory.
  reference:
    - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.html
    - https://www.vmware.com/security/advisories/VMSA-2023-0001.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31704
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31704
    epss-score: 0.81011
    epss-percentile: 0.99635
    cwe-id: CWE-22
    cpe: cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*
  metadata:
    vendor: vmware
    product: vrealize_log_insight
    shodan-query: http.title:"vrealize log insight"
    fofa-query: title="vrealize log insight"
    google-query: intitle:"vrealize log insight"
  tags: cve,cve2022,vmware,vrealize,rce,lfi,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/i18n/component/JS?locale=en-US"
      - "{{BaseURL}}/api/v1/version"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "logInsight", "releaseName\":")'
        condition: and

      - type: dsl
        dsl:
          - "compare_versions(version, '>= 3.0', '< 4.8')"
          - "compare_versions(version, '>= 8.0.0', '< 8.10.2')"
        condition: or

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'version"\s*:\s*"([0-9.]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from