CVE-2022-22948: VMware vCenter Information Disclosure Flaw

CVE-2022-22948 Overview

CVE-2022-22948 is an information disclosure vulnerability affecting VMware vCenter Server due to improper permission of files. This vulnerability allows a malicious actor with non-administrative access to the vCenter Server to exploit insecure file permissions and gain access to sensitive information that should otherwise be restricted to privileged users.

Critical Impact

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Attackers with low-privilege access can leverage this flaw to extract sensitive configuration data, credentials, or other confidential information from vCenter Server deployments.

Affected Products

• VMware vCenter Server 6.5 (all updates through 6.5 Update 3q)
• VMware vCenter Server 6.7 (all updates through 6.7 Update 3o)
• VMware vCenter Server 7.0 (all updates through 7.0 Update 3c)
• VMware Cloud Foundation 3.x
• VMware Cloud Foundation 4.x

Discovery Timeline

• 2022-03-29 - CVE-2022-22948 published to NVD
• 2025-10-31 - Last updated in NVD database

Technical Details for CVE-2022-22948

Vulnerability Analysis

This vulnerability is classified under CWE-276 (Incorrect Default Permissions), indicating that the vCenter Server application sets overly permissive default file permissions during installation or operation. The flaw enables users with legitimate but limited access to the vCenter Server environment to read files containing sensitive information that should be restricted to administrators only.

The attack requires network access and low-level authenticated privileges on the target system. Once authenticated, an attacker can access sensitive files without needing elevated permissions, as the default file permissions fail to properly restrict access. This can lead to exposure of configuration details, database credentials, encryption keys, or other sensitive operational data stored within the vCenter Server file system.

Root Cause

The root cause of CVE-2022-22948 is the improper configuration of file permissions within the vCenter Server installation. Specifically, certain sensitive files are created or maintained with permissions that allow read access to users beyond the intended administrative scope. This represents a failure in the principle of least privilege, where files containing sensitive information should be accessible only to the specific accounts and services that require them for operation.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to first obtain authenticated access to the vCenter Server environment with non-administrative credentials. This could be achieved through:

1. Compromised service account - Gaining access through a low-privilege service account with network connectivity to the vCenter Server
2. Insider threat - A legitimate user with basic access exploiting the misconfigured permissions
3. Lateral movement - An attacker who has compromised another system within the network using those credentials to access sensitive vCenter files

Once authenticated access is obtained, the attacker can navigate to directories containing sensitive files and read their contents due to the overly permissive file permissions. The information obtained could include database connection strings, API tokens, encryption keys, or configuration data that could facilitate further attacks against the virtualization infrastructure.

Detection Methods for CVE-2022-22948

Indicators of Compromise

• Unusual file access patterns to vCenter Server configuration directories by non-administrative accounts
• Audit log entries showing read operations on sensitive configuration files by unexpected user accounts
• Evidence of credential harvesting or unauthorized API calls following suspicious file access events
• Network reconnaissance activity targeting vCenter Server management interfaces

Detection Strategies

• Enable and monitor vCenter Server audit logs for file access events, particularly to sensitive configuration directories
• Implement file integrity monitoring (FIM) on critical vCenter Server configuration files to detect unauthorized access attempts
• Deploy SentinelOne agents on vCenter Server systems to monitor for suspicious process behavior and file access patterns
• Configure SIEM alerts for authentication events from unusual source IPs followed by sensitive file access

Monitoring Recommendations

• Review vCenter Server access logs regularly for accounts accessing files outside their normal operational scope
• Monitor for new account creation or privilege changes that could indicate preparation for exploitation
• Track network connections to vCenter Server management ports from unexpected sources
• Establish baseline file access patterns for legitimate administrative activities to identify anomalous behavior

How to Mitigate CVE-2022-22948

Immediate Actions Required

• Apply the security patches referenced in VMware Security Advisory VMSA-2022-0009 immediately
• Review and restrict network access to vCenter Server management interfaces to authorized administrators only
• Audit current file permissions on sensitive vCenter Server directories and manually restrict as needed pending patch deployment
• Review vCenter Server access logs for evidence of exploitation attempts or unauthorized data access

Patch Information

VMware has released security patches to address CVE-2022-22948 across all affected product versions. Organizations should consult the VMware Security Advisory VMSA-2022-0009 for specific patch versions and download links. Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, patching should be treated as a high priority regardless of the medium severity rating.

Workarounds

• Implement network segmentation to limit access to vCenter Server management interfaces to only authorized administrative workstations
• Review and manually restrict file permissions on sensitive configuration files if immediate patching is not feasible
• Enable enhanced logging and monitoring to detect potential exploitation attempts while awaiting patch deployment
• Consider temporarily restricting non-administrative user access to vCenter Server until patches can be applied

# Example: Verify file permissions on vCenter Server (Linux appliance)
# Check permissions on sensitive configuration directories
ls -la /etc/vmware-vpx/
ls -la /storage/db/
# Look for world-readable files that should be restricted
find /etc/vmware-vpx -perm -o+r -type f