A security advisory has been released by VMware this week detailing 5 security vulnerabilities that have been addressed in the recent update of VMware Workspace ONE Assist, a remote screen sharing and command execution tool used by help desk and IT staff. Three of these vulnerabilities have been assigned a critical severity rating, and a CVSS base score of 9.8 due to the potential exploit of these flaws resulting in non-authenticated attackers obtaining administrative privileges.  

CVE-2022-31685 is a critical authentication bypass vulnerability that if exploited could allow an attacker to obtain admin level access without needing to authenticate within the application. The other two critical severity vulnerabilities have similar effects, with threat actors able to gain admin privileges without the need to authenticate. CVE-2022-31686 facilitates this through a broken authentication method, while CVE-2022-31687 allows for this attack through broken access control.  

The other two vulnerabilities patched in this update are rated as moderate severity, for CVE-2022-31688 this is due to the need for user interaction for an successful exploit to take place. This is a reflected cross site scripting (XSS) vulnerability, which allows an attacker to exploit improper input sanitisation in the application. With the aid of some user interaction, the attacker can then inject JavaScript code into the window viewed by the victim. CVE-2022-31689 is also a moderate severity vulnerability, as a valid session token is required for this exploit. Attackers can use this session fixation vulnerability to obtain an already authenticated session token, and then use this to validate their own session in the application.  

Users can update to the newest version, Workspace ONE Assist 22.10, in order to apply security patches for all 5 vulnerabilities, as well as receive some non-security feature updates. There are no published workarounds for any of these vulnerabilities, so users should apply the new update as soon as possible in order to protect themselves from any potential attack exploiting these flaws.