CVE-2020-3961: VMware Horizon Client Privilege Escalation

CVE-2020-3961 Overview

CVE-2020-3961 is a privilege escalation vulnerability affecting VMware Horizon Client for Windows versions prior to 5.4.3. The vulnerability stems from insecure folder permission configuration combined with unsafe library loading practices. A local authenticated attacker can exploit this flaw to execute arbitrary commands with elevated privileges, potentially gaining complete control over the affected system.

Critical Impact

Local privilege escalation allows authenticated users to execute commands as any user on the system, potentially compromising enterprise virtual desktop infrastructure environments.

Affected Products

• VMware Horizon Client for Windows (versions prior to 5.4.3)
• Microsoft Windows (as the underlying operating system)

Discovery Timeline

• 2020-06-15 - CVE-2020-3961 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-3961

Vulnerability Analysis

This vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The flaw exists within the VMware Horizon Client for Windows installation, where folder permissions are improperly configured, allowing local users to manipulate files or directories that should be protected. Combined with unsafe DLL loading behavior, this creates a privilege escalation path that attackers can leverage to execute malicious code with elevated privileges.

The attack requires local access to the system where VMware Horizon Client is installed, meaning the attacker must already have authenticated user-level access. However, once exploited, the vulnerability allows command execution as any user, including privileged accounts such as SYSTEM or Administrator.

Root Cause

The root cause of CVE-2020-3961 lies in two interconnected issues:

1. Insecure Folder Permissions: The VMware Horizon Client installation creates directories with overly permissive access controls, allowing standard users to write or modify files in sensitive locations.

2. Unsafe Library Loading: The application loads DLL libraries without proper path validation, making it susceptible to DLL hijacking attacks. When the application searches for required libraries, an attacker can place a malicious DLL in a writable location that is searched before the legitimate library location.

Attack Vector

The attack vector is local, requiring an authenticated user on the Windows system where VMware Horizon Client is installed. The exploitation process typically involves:

1. Identifying writable directories used by the Horizon Client service or application
2. Crafting a malicious DLL that will be loaded by the vulnerable application
3. Placing the malicious DLL in the identified writable location
4. Triggering the application to load the malicious library, resulting in code execution with elevated privileges

The attacker can then execute arbitrary commands as any user on the system, effectively bypassing the principle of least privilege and gaining unauthorized access to sensitive resources.

Detection Methods for CVE-2020-3961

Indicators of Compromise

• Unexpected DLL files appearing in VMware Horizon Client installation directories
• Unusual process execution patterns from VMware Horizon Client processes
• Modifications to folder permissions on VMware-related directories
• Evidence of privilege escalation attempts in Windows Security Event logs

Detection Strategies

• Monitor for file creation events in VMware Horizon Client installation directories, particularly DLL files
• Implement application whitelisting to detect unauthorized library loading
• Configure endpoint detection to alert on suspicious parent-child process relationships involving vmware-view.exe
• Review Windows Event Logs (Event ID 4688) for process creation events with unexpected user contexts

Monitoring Recommendations

• Deploy file integrity monitoring on VMware Horizon Client installation directories
• Enable PowerShell script block logging to detect privilege escalation attempts
• Configure SIEM alerts for local privilege escalation patterns on systems running VMware Horizon Client
• Regularly audit folder permissions on critical application directories

How to Mitigate CVE-2020-3961

Immediate Actions Required

• Update VMware Horizon Client for Windows to version 5.4.3 or later immediately
• Audit all systems running VMware Horizon Client to identify vulnerable versions
• Review and restrict folder permissions on VMware Horizon Client installation directories
• Implement the principle of least privilege for user accounts on affected systems

Patch Information

VMware has released version 5.4.3 of the Horizon Client for Windows that addresses this vulnerability. Organizations should prioritize updating to this version or later. For detailed patch information and download links, refer to the VMware Security Advisory VMSA-2020-0013.

Workarounds

• Restrict write access to VMware Horizon Client installation directories to administrators only
• Implement application control policies to prevent unauthorized DLL loading
• Consider using Windows Defender Application Control (WDAC) to enforce code integrity
• Limit local user accounts on systems where VMware Horizon Client is installed

# Verify VMware Horizon Client version (PowerShell)
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Horizon Client*" } | Select-Object Name, Version

# Audit folder permissions on VMware installation directory
icacls "C:\Program Files\VMware\VMware Horizon View Client" /T