VMware vRealize Log Insight - Path Traversal

criticalseverity

9.8CVSS score

87.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

he vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.

Impact

A remote, unauthenticated attacker can inject malicious files leading to remote code execution on the target appliance, resulting in complete compromise of the affected system.

Fix

Update VMware vRealize Log Insight to version 8.10.2 or later as per the official vendor advisory.

How to confirm it

Send: GET {{BaseURL}}/i18n/component/JS?locale=en-US ; GET {{BaseURL}}/api/v1/version
Positive when: status_code == 200 and contains_any(body, "logInsight", "releaseName\":") AND compare_versions(version, '>= 8.0.0', '< 8.10.2') or compare_versions(version, '>= 3.0', '< 4.8')

Run it with nuclei: nuclei -id CVE-2022-31706 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-31706

info:
  name: VMware vRealize Log Insight - Path Traversal
  author: ritikchaddha
  severity: critical
  description: |
    he vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
  impact: |
    A remote, unauthenticated attacker can inject malicious files leading to remote code execution on the target appliance, resulting in complete compromise of the affected system.
  remediation: |
    Update VMware vRealize Log Insight to version 8.10.2 or later as per the official vendor advisory.
  reference:
    - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.html
    - https://www.vmware.com/security/advisories/VMSA-2023-0001.html
    - https://nvd.nist.gov/vuln/detail/cve-2022-31706
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31706
    epss-score: 0.87077
    epss-percentile: 0.9975
    cwe-id: CWE-22
    cpe: cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*
  metadata:
    vendor: vmware
    product: vrealize_log_insight
    shodan-query: http.title:"vrealize log insight"
    fofa-query: title="vrealize log insight"
    google-query: intitle:"vrealize log insight"
  tags: cve,cve2022,vmware,vrealize,rce,lfi,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/i18n/component/JS?locale=en-US"
      - "{{BaseURL}}/api/v1/version"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "logInsight", "releaseName\":")'
        condition: and

      - type: dsl
        dsl:
          - "compare_versions(version, '>= 8.0.0', '< 8.10.2')"
          - "compare_versions(version, '>= 3.0', '< 4.8')"
        condition: or

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'version"\s*:\s*"([0-9.]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from