VMware fixes three critical auth bypass bugs in remote access tool

VMware has released security updates to address three critical severity vulnerabilities in the Workspace ONE Assist solution that enable remote attackers to bypass authentication and elevate privileges to admin.

Workspace ONE Assist provides remote control, screen sharing, file system management, and remote command execution to help desk and IT staff remotely access and troubleshoot devices in real time from the Workspace ONE console.

The flaws are tracked as CVE-2022-31685 (authentication bypass), CVE-2022-31686 (broken authentication method), and CVE-2022-31687 (broken authentication control) and have received 9.8/10 CVSSv3 base scores.

Non-authenticated threat actors can exploit them in low-complexity attacks that don't require user interaction for privilege escalation.

"A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application," VMware describes the three security bugs.

Fixed in Workspace ONE Assist 22.10

The company patched them today with the release of Workspace ONE Assist 22.10 (89993) for Windows customers.

VMware also patched a reflected cross-site scripting (XSS) vulnerability (CVE-2022-31688) that enables attackers to inject javascript code in the target user's window and a session fixation vulnerability (CVE-2022-31689) that allows authentication after obtaining a valid session token.

All vulnerabilities patched today have been found and reported to VMware by Jasper Westerman, Jan van der Put, Yanick de Pater, and Harm Blankers of REQON IT-Security.

In August, VMware warned admins to patch another critical authentication bypass security flaw in VMware Workspace ONE Access, Identity Manager, and vRealize Automation, enabling unauthenticated attackers to gain admin privileges.

One week later, the company revealed that proof-of-concept (PoC) exploit code was released online after the researcher who discovered and reported the vulnerability shared a PoC exploit.

In May, VMware patched an almost identical critical vulnerability, another authentication bypass (CVE-2022-22972) found by Bruno López of Innotec Security in Workspace ONE Access, VMware Identity Manager (vIDM), and vRealize Automation.

Source