CVE-2021-22037 Path traversal in VMware InstallBuilder
Attackers can execute arbitrary code by planting a malicious reg.exe binary that takes precedence over the system command during installer execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-22037?
CVE-2021-22037 is a high-severity path traversal vulnerability in VMware InstallBuilder, published on 29 Oct 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforced, which results in a search in the search path until a binary can be identified. This makes the installer/uninstaller vulnerable to Path Interception by Search Order Hijacking, potentially allowing an attacker to plant a malicious reg.exe command so it takes precedence over the system command. The vulnerability only affects Windows installers.
Weakness: CWE-427
Which versions are affected by CVE-2021-22037?
It affects 1 product.
Products include Vmware Installbuilder.
How do I fix CVE-2021-22037?
No fix has been published for CVE-2021-22037 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-22037 being exploited?
There is no known exploitation of CVE-2021-22037 in the wild and no public exploit code.
Other vulnerabilities in VMware InstallBuilder
Sources
Also known as GHSA-jv5m-f67h-gh5c.