VMware vRealize Log Insight < v8.10.2 - Information Disclosure

mediumseverity

5.3CVSS score

22.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication.

Impact

Attackers can access sensitive session and application data, leading to potential information leakage and security breaches."

Fix

Apply the latest security patches and updates provided by VMware to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/i18n/component/JS?locale=en-US ; GET {{BaseURL}}/api/v1/version
Positive when: status_code == 200 and contains_any(body, "logInsight", "releaseName\":") AND compare_versions(version, '>= 8.0.0', '< 8.10.2') or compare_versions(version, '>= 3.0', '< 4.8')

Run it with nuclei: nuclei -id CVE-2022-31711 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-31711

info:
  name: VMware vRealize Log Insight < v8.10.2 - Information Disclosure
  author: DhiyaneshDK
  severity: medium
  description: |
    VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication.
  impact: |
    Attackers can access sensitive session and application data, leading to potential information leakage and security breaches."
  remediation: |
    Apply the latest security patches and updates provided by VMware to mitigate this vulnerability.
  reference:
    - http://packetstormsecurity.com/files/174606/VMware-vRealize-Log-Insight-Unauthenticated-Remote-Code-Execution.html
    - https://github.com/horizon3ai/vRealizeLogInsightRCE
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-31711
    epss-score: 0.22304
    epss-percentile: 0.97704
    cpe: cpe:2.3:a:vmware:vrealize_log_insight:*:*:*:*:*:*:*:*
  metadata:
    vendor: vmware
    product: vrealize_log_insight
    shodan-query: http.title:"vrealize log insight"
    fofa-query: title="vrealize log insight"
    google-query: intitle:"vrealize log insight"
  tags: cve,cve2022,vmware,exposure,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/i18n/component/JS?locale=en-US"
      - "{{BaseURL}}/api/v1/version"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "logInsight", "releaseName\":")'
        condition: and

      - type: dsl
        dsl:
          - "compare_versions(version, '>= 8.0.0', '< 8.10.2')"
          - "compare_versions(version, '>= 3.0', '< 4.8')"
        condition: or

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'version"\s*:\s*"([0-9.]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from