VMWare-LPE-2022-22960

Description

The query checks process command being placed into the script; CVE-2022-22960 allows a user to write to it and be executed as root. This vulnerability of VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. CVE: CVE-2022-22960. Read more here:. https://www.cisa.gov/uscert/ncas/alerts/aa22-138b https://www.vmware.com/security/advisories/VMSA-2022-0011.html Tags: #exploit #CVE-2022-22960

Query · kql

DeviceProcessEvents
| where InitiatingProcessCommandLine has_any ("/opt/vmware/certproxy/bing/certproxyService.sh", "/horizon/scripts/exportCustomGroupUsers.sh", "/horizon/scripts/extractUserIdFromDatabase.sh")
    or FileName has_any ("certproxyService.sh", "exportCustomGroupUsers.sh", "extractUserIdFromDatabase.sh ")
| project Timestamp, DeviceName , FileName, ProcessCommandLine, InitiatingProcessCommandLine
Raw source VMWare-LPE-2022-22960 · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1d468d49-ffea-4daf-ba6b-72525ec17b61
name: VMWare-LPE-2022-22960
description: |
  The query checks process command being placed into the script; CVE-2022-22960 allows a user to write to it and be executed as root.
  This vulnerability of VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
  CVE: CVE-2022-22960.
  Read more here:.
  https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
  https://www.vmware.com/security/advisories/VMSA-2022-0011.html
  Tags: #exploit #CVE-2022-22960
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
  - Execution
  - Privilege Escalation
relevantTechniques:
  - T1204
  - T1548
query: |
  DeviceProcessEvents
  | where InitiatingProcessCommandLine has_any ("/opt/vmware/certproxy/bing/certproxyService.sh", "/horizon/scripts/exportCustomGroupUsers.sh", "/horizon/scripts/extractUserIdFromDatabase.sh")
      or FileName has_any ("certproxyService.sh", "exportCustomGroupUsers.sh", "extractUserIdFromDatabase.sh ")
  | project Timestamp, DeviceName , FileName, ProcessCommandLine, InitiatingProcessCommandLine

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.