Database/Control plane, storage & DevOps

VMware vRealize Operations: low-privileged user can create and read hex dumps, leaking data toward RCE

CVSS 8.8CVE-2022-31673Control plane, storage & DevOpscurated

Impact

A user with only low privileges on the vRealize Operations appliance can make the product generate and then retrieve hex dumps, exposing process memory contents. VMware states successful exploitation can lead to remote code execution. vROps is the monitoring and capacity plane for a vSphere estate, so it holds vCenter service credentials and inventory for every host it watches - including GPU hosts running vGPU or passthrough workloads. Whoever controls it can read fleet-wide telemetry and, with the credentials it stores, reach the virtualization control plane. The record does not describe which data the dumps contain beyond the information-disclosure-to-RCE chain, so treat the specific secrets exposed as unknown.

Who can reach it

Network access to the vRealize Operations web interface plus a low-privileged authenticated account. In most estates that interface sits on the management network, so the practical precondition is any account on the monitoring appliance - not necessarily an administrator.

What to do

Patch the appliance to the fixed vRealize Operations build listed in VMSA-2022-0022 and restart it; VMware published no workaround for this issue. This is an appliance upgrade on the management plane, not a hypervisor change - no ESXi host drain or VM downtime. Because credentials may already have been read, rotate the vCenter and other service accounts configured in vROps after patching, and review account inventory on the appliance for unnecessary low-privileged users.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-31673 https://www.vmware.com/security/advisories/VMSA-2022-0022.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.