CVE-2021-22037: 
VMware InstallBuilder vulnerability analysis and mitigation

CVE-2021-22037 is a security vulnerability affecting VMware InstallBuilder's Windows installers. The vulnerability was discovered and disclosed in October 2021, affecting all versions prior to 21.6.0. Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command without enforcing its full path, making the installer/uninstaller vulnerable to Path Interception by Search Order Hijacking (InstallBuilder Blog).

The vulnerability occurs when InstallBuilder performs registry operations using reg.exe system command without specifying its full path. This results in a search through the system path until a binary is identified, potentially allowing an attacker to exploit the search order. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector with low attack complexity, no privileges required, and user interaction required (NVD).

If successfully exploited, this vulnerability could allow an attacker to plant a malicious reg.exe command that takes precedence over the system command, enabling execution with the security scope of the installer/uninstaller. This could potentially lead to high impacts on confidentiality, integrity, and availability of the affected system (InstallBuilder Blog).

The vulnerability requires previous access to the machine to plant the malicious library before the vulnerable installer is executed. The attack is limited to Windows installations only. The vulnerability has been classified with a local attack vector, requiring user interaction but no privileges (NVD).

VMware has addressed this vulnerability in InstallBuilder version 21.6.0. Affected customers are advised to update to InstallBuilder 21.6.0 or later and release new versions of their installers. The fix enforces the full path to the reg command on Windows systems (InstallBuilder Blog).