CVE-2022-31661: 
Workspace ONE Access Connector vulnerability analysis and mitigation

CVE-2022-31661 is a local privilege escalation vulnerability affecting VMware Workspace ONE Access, Identity Manager, and vRealize Automation products. The vulnerability was discovered by Spencer McIntyre of Rapid7 in June 2022 and disclosed to VMware, who released patches in August 2022. The vulnerability has been assigned a CVSS score of 7.8, indicating important severity (VMware Advisory).

The vulnerability exists in the under-privileged horizon user account, which runs the externally accessible web application. The vulnerability allows the horizon user to escalate their permissions to those of the root user. The issue arises from the fact that the /usr/local/horizon/scripts/getProtectedLogFiles.hzn script can be run with root privileges without a password using the sudo command. This script recursively changes the ownership of a user-supplied directory to the horizon user, effectively granting them write permissions to all contents (Rapid7 Blog).

A malicious actor with local access can escalate privileges to 'root'. While the vulnerability requires local access to exploit, it becomes particularly dangerous when chained with remote code execution vulnerabilities like CVE-2022-22954, potentially allowing attackers to go from no access to root access in two steps (VMware Advisory, Rapid7 Blog).

The vulnerability requires local access and the attacker must have horizon user privileges to exploit. A proof-of-concept exploit was developed and submitted as a Metasploit module in PR #16854. The exploit involves executing specific commands as the horizon user to gain root privileges (Rapid7 Blog).

VMware has released patches to address this vulnerability in the affected products. Users should apply the patches listed in the 'Fixed Version' column of the Resolution Matrix as detailed in VMware Security Advisory VMSA-2022-0021. No workarounds are available for this vulnerability, making patch application the only remediation option (VMware Advisory).