VMware Horizon Remote Code Execution (RCE) Scanner
Detects 'Remote Code Execution (RCE)' vulnerability in VMware Horizon.
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
23 days 3 hours
Scan only one
Domain, Subdomain, IPv4
Toolbox
VMware Horizon is a virtual desktop infrastructure (VDI) solution used by enterprises to deliver, manage, and secure virtual desktops and applications. It is typically employed in environments where companies need to provide secure remote access to employees, contractors, or partners. With its robust features, VMware Horizon allows users to work remotely from any location while maintaining company security protocols. Enterprises use it to streamline IT processes, reduce operational costs, and ensure consistent desktop environments for end-users. By leveraging the benefits of virtualization, VMware Horizon is integral to businesses prioritizing remote work capabilities.
The Remote Code Execution (RCE) vulnerability in VMware Horizon involves a critical flaw that allows attackers to inject and execute arbitrary code remotely. Such vulnerabilities could be exploited without requiring valid user credentials, making them highly dangerous. Enabling unauthorized access to the system, this vulnerability can compromise the integrity, confidentiality, and availability of the system. Developed by experts at Apache, the Log4j framework is susceptible due to compositions in JNDI lookups. The flaw is specifically triggered by the way JNDI references are handled.
In VMware Horizon, the flaw is located within the Apache Log4j library, which is used for logging functionalities. Attackers exploit the vulnerability via uncontrolled JNDI lookups, directing the application to load and execute external code. This happens when certain protocol configurations in Log4j allow untrusted data to be interpreted and executed. An attacker sends crafted input to the server that invokes JNDI while specifying a malicious LDAP server to deliver the payload. Consequently, this allows the attacker to remotely implant arbitrary code on unpatched systems running the vulnerable Log4j version.
The exploitation of this RCE vulnerability can have devastating effects, including the full compromise of targeted systems. Malicious actors could potentially execute arbitrary system commands, access sensitive data, and even introduce malware into the environment. Once exploited, attackers might leverage the compromised system to move laterally within the network, expanding their control and causing further damage. Organizations could face data breaches, service outages, and reputational damage as a result of successful exploits. The unauthorized access could also lead to significant financial losses due to recovery efforts, fines, and legal implications.
REFERENCES
