CISA Issues VMware Emergency Directive: Why it matters and how CloudCover protects VMware against vulnerabilities.

On Wednesday, May 18th, VMware disclosed multiple security flaws in VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation, and vRealize Suite Lifecycle Manager. These newly discovered vulnerabilities in VMware products put customers at serious risk.

At CloudCover, we explain what VMware announced, what it means and how our CloudCover CC/B1 Platform™ helps keep customers’ networks safe against newly disclosed vulnerabilities such as VMware’s security announcement.

What threat does the VMware vulnerability pose?

The vulnerabilities are being tracked as CVE-2022-22972 and CVE-2022-22973, which are respectively an authentication bypass with a severity score of 9.8 out of 10, and a local privilege escalation vulnerability with a score of 7.8. The CVE-2022-22972 could allow a malicious actor with network access to the VMware UI to obtain administrative access without the need to authenticate. CVE-2022-22973 could allow a malicious actor with local access to escalate privileges to ‘root’.

Security firm Rapid7 observed active exploitation in the wild on April 12, 2022, six days after VMware issued patches. Soon after, several public proof-of-concept exploits were being used to install coin miners on vulnerable systems. (Tung, 2022). VMware has already released patches, and customers should patch as quickly as possible (patch information found here: https://www.vmware.com/security/advisories/VMSA-2022-0014.html). CloudCover CC/B1 customers additionally benefit from signature coverage for these exploits.

The hype around VMware vulnerabilities is serious for two reasons:

1. The VMware blog: “When a security researcher finds a vulnerability it often draws the attention of other security researchers, who bring different perspectives and experience to the research. VMware recognizes that additional patches are inconvenient for IT staff, but we balance that concern with a commitment to transparency, keeping our customers informed and ahead of potential attacks,” the company wrote in a blog post.

2. Are there any downsides to using workaround? The workaround will make admins unable to log into the Workspace ONE Access console using the local admin account, which may impact your organization’s operations. The only way to remove the vulnerabilities from your environment is to apply the patches provided in VMSA-2022-0014. Workarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not. While the decision to patch or use the workaround is yours, VMware always strongly recommends patching as the simplest and most reliable way to resolve this type of issue.

For these reasons, the initial VMware vulnerability and attacks are just the beginning. Please follow the extended support process to request patches and other information.

How does CloudCover’s CC/B1 protect against VMware’s newly announced vulnerabilities?

CloudCover has possessed signatures for this specific attack vector since its discovery on April 12-13, 2022, and variant signatures against similar attack vectors for the past several years. CloudCover’s CC/B1 detects this non-authenticated vulnerability attack with its signature base and its risk-analytic AWARE engine, blocking offending traffic automatically.

This one-two punch of risk aware and risk control helps our customers know whether they’ve been affected by the VMware vulnerabilities. Because the CC/B1 blocks these CVE-2022-22972 and CVE-2022-22973 exploit attempts when detected, our CC/B1 customers spend far less time on the security “threat hunt”.

What’s the best way to protect against VMware’s newly announced vulnerabilities?

First, the good news. VMware’s vulnerability is being remediated, with patch management software for companies using the affected platforms and programs. The vulnerability itself doesn’t migrate or mutate, so it won’t actually evolve. And as new exploit variants and signatures are identified, detection rules can be updated to recognize and block them.

What’s the best way to protect against the VMware vulnerability? Making the shift to the new era of CyberSafety — being aware of your network security threats, stopping detected attacks with CC/B1’s deep inspection and transferring the risk of those attacks through cybersecurity network insurance.

Our CC/B1 Platform can assist with your CyberSafety shift. Request a demo today or send an email to sales@cloudcover.net.

References:

Tung, Liam (May 19, 2022). “Patch these vulnerable VMware products or remove them from your network, CISA warns federal agencies.” ZDNet. https://www.zdnet.com/article/patch-these-vulnerable-vmware-products-or-remove-them-from-your-network-cisa-warns-federal-agencies/

Jason Miller (May 18, 2022 4:11 pm) “CISA issues rare emergency directive as ‘critical’ cyber vulnerabilities emerge.” https://federalnewsnetwork.com/cybersecurity/2022/05/cisa-issues-rare-emergency-directive-as-critical-cyber-vulnerabilities-emerge/