Horizon Alert
Summary of the vulnerability and why it matters
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector are susceptible to a command injection vulnerability. This flaw allows an attacker with administrative access to the configurator to execute commands with unrestricted privileges on the underlying operating system. The potential impact includes unauthorized system control and data compromise.
- Vulnerable VMware management interfaces.
- Unrestricted command execution capability.
- Compromise of underlying operating systems.
Attack Path
How an attacker could exploit the issue
This vulnerability allows an attacker to execute commands on the underlying operating system. The attack requires an attacker to first gain access to the administrative configurator interface, which is accessible over the network. Once authenticated, the attacker can exploit the vulnerability to achieve control over the system.
- Network access to administrative configurator.
- Authenticated access to administrative interface.
- Execute commands, gain system control.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability presents a significant threat due to its potential for widespread impact. Attackers with administrative credentials could gain complete control over affected systems, leading to data compromise and disruption of critical business operations. The complexity of exploitation is low, making it accessible to a broad range of malicious actors.
- Likely attacker skill level: Moderate.
- Required access or conditions: Administrative credentials.
- Business risk or urgency: High.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector have a command injection vulnerability that could allow an attacker to execute commands with unrestricted privileges on the operating system. This could impact system integrity and lead to unauthorized access to sensitive data. The business risk associated with this vulnerability is significant due to the potential for full system compromise.
- Identify all instances of affected VMware products.
- Restrict network access to administrative interfaces.
- Apply vendor updates, verify, and monitor.
