SRC-2022-0020 : VMware vRealize Operations Manager generateSupportBundle VCOPS_BASE Privilege Escalation Vulnerability

Vulnerability Details:

This vulnerability allows local attackers to escalate privileges on affected installations of VMware vRealize Operations Manager. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within generateSupportBundle.py script. The issue results from allowing attackers to specify the VCOPS_BASE environment variable which is later used to construct a path. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.

Affected Vendors:

VMWare

Affected Products:

vRealize Operations

Vendor Response:

VMWare has issued an update to correct this vulnerability. More details can be found at: <https://www.vmware.com/security/advisories/VMSA-2022-0022.html&gt;
Proof of Concept:
<https://github.com/sourceincite/DashOverride&gt;