CVE-2020-3950
published 2020-03-17CVE-2020-3950: VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)…
PriorityP181high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
7.25%
93.7th percentile
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | fusion | >= 11.0.0 < 11.5.2 | 11.5.2 |
| vmware | horizon_client | >= 5.0.0 < 5.4.0 | 5.4.0 |
| vmware | remote_console | >= 11.0.0 < 11.0.1 | 11.0.1 |
Detection & IOCsextracted from sources · hover to see the quote
urlhttps://raw.githubusercontent.com/mirchr/security-research/master/vulnerabilities/CVE-2020-3950.sh↗
commandln '/Applications/VMware Fusion.app/Contents/Library/services/Open VMware USB Arbitrator Service' '#{link_folder}#{open_usb_service}'↗
commandplutil -p '/Applications/VMware Fusion.app/Contents/Info.plist' | grep CFBundleShortVersionString↗
- →Monitor for hard link creation targeting '/Applications/VMware Fusion.app/Contents/Library/services/Open VMware USB Arbitrator Service' from non-standard directories, which is the core exploitation primitive. ↗
- →Alert on creation of the directory path ~/Contents/Library/services/ under a non-root user home directory, as this is the attacker-controlled payload staging path. ↗
- →Detect 'Open VMware USB Arbitrator Service' executing from a path other than '/Applications/VMware Fusion.app/Contents/Library/services/' — execution from a user home directory subdirectory is malicious. ↗
- →Watch for rapid repeated hard-link swapping (ln -f) between the legitimate VMware USB Arbitrator Service binary and an attacker payload in the same directory — indicative of the TOCTOU race condition exploit for 11.5.3. ↗
- →Detect processes spawned with effective UID 0 (root) whose parent is 'Open VMware USB Arbitrator Service' running from a user-writable path. ↗
- →Flag execution of $HOME/.woot or any hidden executable in the user home directory shortly after VMware USB Arbitrator Service activity — this is the dropped payload in the PoC. ↗
- →Monitor for pkill or kill -9 targeting 'Open VMware USB Arbitrator Service' from a non-privileged user session, used to clean up after exploitation. ↗
- ·The Metasploit module targets VMware Fusion versions 10.1.3 through 11.5.3; the pre-11.5.3 and 11.5.3-specific code paths differ (direct execution vs. TOCTOU race). Detection logic should account for both variants. ↗
- ·The 11.5.3 TOCTOU race exploit requires up to MAXATTEMPTS (default 75) iterations to win the race; detection based on a single ln -f event may miss it — look for high-frequency repeated hard-link swaps. ↗
- ·The exploit also affects VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0), not only VMware Fusion — detection scope should cover all three products. ↗
- ·The exploit requires an existing low-privileged shell or Meterpreter session on the target macOS host; it is a local privilege escalation, not a remote exploit. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
VMware Multiple Products Privilege Escalation Vulnerability
cisa·2021-11-03·CVSS 7.8
CVE-2020-3950 [HIGH] CWE-269 VMware Multiple Products Privilege Escalation Vulnerability
Vulnerability: VMware Multiple Products Privilege Escalation Vulnerability
Affected: VMware Multiple Products
VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-3950
Remediation Due Date: 2022-05-03
VMware
VMware Workstation, Fusion, VMware Remote Console and Horizon Client updates address privilege escalation and denial-of-service vulnerabilities (CVE-2020-3950, CVE-2020-3951)
vendor_vmware·2020-03-17·CVSS 7.8
CVE-2020-3950 [HIGH] VMware Workstation, Fusion, VMware Remote Console and Horizon Client updates address privilege escalation and denial-of-service vulnerabilities (CVE-2020-3950, CVE-2020-3951)
VMSA-2020-0005: VMware Workstation, Fusion, VMware Remote Console and Horizon Client updates address privilege escalation and denial-of-service vulnerabilities (CVE-2020-3950, CVE-2020-3951)
VMware Fusion, VMRC for Mac and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.3.
CVEs: CVE-2020-3950, CVE-2020-3951
Affected products: ESXi, Fusion Pro, Horizon Client, VMware Fusion, VMware Horizon, VMware Workstation, VMware vSphere, Workstation Player, Workstation Pro
GHSA
GHSA-fx3w-hj7j-hfgf: VMware Fusion (11
ghsa_unreviewed·2022-05-24
CVE-2020-3950 [HIGH] CWE-269 GHSA-fx3w-hj7j-hfgf: VMware Fusion (11
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
VulnCheck
VMware Multiple Products Privilege Escalation Vulnerability
vulncheck·2020·CVSS 7.8
CVE-2020-3950 [HIGH] CWE-269 VMware Multiple Products Privilege Escalation Vulnerability
VMware Multiple Products Privilege Escalation Vulnerability
VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root.
Affected: VMware Multiple Products
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/f72b3088d1fe
Remediation Due: 2022-05-03
No detection rules found.
Exploit-DB
VMware Fusion - USB Arbitrator Setuid Privilege Escalation (Metasploit)
exploitdb·2020-04-16
CVE-2020-3950 VMware Fusion - USB Arbitrator Setuid Privilege Escalation (Metasploit)
VMware Fusion - USB Arbitrator Setuid Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'VMware Fusion USB Arbitrator Setuid Privilege Escalation',
'Description' => %q(
This exploits an improper use of setuid binaries within VMware Fusion 10.1.3 - 11.5.3.
The Open VMware USB Arbitrator Service can be launched outide of its standard path
which allows loading of an attacker controlled binary. By creating a payload in the
user home directory in a specific folder, and creating a hard link to the 'Open VMware
USB Arbitrator Service' binary, we're able to launch it temporarily to start our payload
with an effective UID of 0.
@jeffball55 discovere
Exploit-DB
VMware Fusion 11.5.2 - Privilege Escalation
exploitdb·2020-03-20·CVSS 7.8
CVE-2020-3950 [HIGH] VMware Fusion 11.5.2 - Privilege Escalation
VMware Fusion 11.5.2 - Privilege Escalation
---
# Exploit Title: VMware Fusion 11.5.2 - Privilege Escalation
# Date: 2020-03-17
# Exploit Author: Rich Mirch
# Vendor Homepage: https://www.vmware.com/products/fusion.html
# Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2020-0005.html
# Software Link: https://download3.vmware.com/software/fusion/file/VMware-Fusion-11.5.1-15018442.dmg
# Versions:
# VMware Fusion Professional 11.5.1 (15018442)
# VMware Fusion Professional 11.5.2 (15794494)
#
# Tested on: macOS 10.14.6
# CVE : CVE-2020-3950
# Source PoC: https://raw.githubusercontent.com/mirchr/security-research/master/vulnerabilities/CVE-2020-3950.sh
#
#
#!/bin/bash
echo "CVE-2020-3950 VMware Fusion EoP PoC by @0xm1rch"
mkdir -p ~/a/b/c
mkdir -p ~/Contents/Library/services
Metasploit
VMware Fusion USB Arbitrator Setuid Privilege Escalation
metasploit
VMware Fusion USB Arbitrator Setuid Privilege Escalation
VMware Fusion USB Arbitrator Setuid Privilege Escalation
This exploits an improper use of setuid binaries within VMware Fusion 10.1.3 - 11.5.3. The Open VMware USB Arbitrator Service can be launched outide of its standard path which allows loading of an attacker controlled binary. By creating a payload in the user home directory in a specific folder, and creating a hard link to the 'Open VMware USB Arbitrator Service' binary, we're able to launch it temporarily to start our payload with an effective UID of 0. @jeffball55 discovered an incomplete patch in 11.5.3 with a TOCTOU race. Successfully tested against 10.1.6, 11.5.1, 11.5.2, and 11.5.3.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.htmlhttps://www.vmware.com/security/advisories/VMSA-2020-0005.htmlhttp://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.htmlhttps://www.vmware.com/security/advisories/VMSA-2020-0005.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-3950
2020-03-17
Published
2021-11-03
Added to CISA KEV
Exploited in the wild