CVE-2021-22000
📋 TL;DR
CVE-2021-22000 is a DLL hijacking vulnerability in VMware ThinApp that allows attackers with local non-administrative access to execute arbitrary code with elevated privileges. This affects Windows systems running vulnerable versions of VMware ThinApp. Successful exploitation could lead to full system compromise.
💻 Affected Systems
- VMware ThinApp
📦 What is this software?
Thinapp by Vmware
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrator privileges, allowing installation of persistent malware, credential theft, and lateral movement across the network.
Likely Case
Local privilege escalation leading to administrative control of the affected Windows system, enabling further attacks within the environment.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though local privilege escalation remains possible.
🎯 Exploit Status
Exploitation requires local access and knowledge of DLL placement. Public proof-of-concept code is available, making exploitation straightforward for attackers with initial access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.10
Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2021-0015.html
Restart Required: Yes
Instructions:
1. Download VMware ThinApp version 5.2.10 or later from VMware's official website. 2. Uninstall the vulnerable version. 3. Install the patched version. 4. Restart the system to ensure all changes take effect.
🔧 Temporary Workarounds
Restrict DLL search path
windowsConfigure Windows to restrict DLL search paths and prevent loading from insecure locations
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name 'SafeDllSearchMode' -Value 1
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name 'CWDIllegalInDllSearch' -Value 1
Remove vulnerable ThinApp versions
windowsUninstall vulnerable versions of VMware ThinApp if not required
appwiz.cpl
Select VMware ThinApp and click Uninstall
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges and prevent unauthorized local access
- Deploy application whitelisting to prevent execution of unauthorized DLLs and monitor for suspicious DLL loading behavior
🔍 How to Verify
Check if Vulnerable:
Check the installed version of VMware ThinApp via Control Panel > Programs and Features or using PowerShell: Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like '*ThinApp*'} | Select-Object Name, VersionCheck Version:
Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like '*ThinApp*'} | Select-Object VersionVerify Fix Applied:
Verify the installed version is 5.2.10 or later using the same method as checking vulnerability📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing DLL loading from unusual locations
- Process creation events for ThinApp with suspicious parent processes
- Failed DLL loading attempts from non-standard paths
Network Indicators:
- Unusual outbound connections from systems running ThinApp
- Lateral movement attempts following privilege escalation
SIEM Query:
EventID=4688 AND (NewProcessName LIKE '%thinapp%' OR NewProcessName LIKE '%vmware%') AND ParentProcessName NOT IN ('explorer.exe', 'svchost.exe')🔗 References
- http://packetstormsecurity.com/files/163521/VMware-ThinApp-DLL-Hijacking.html
- http://seclists.org/fulldisclosure/2021/Jul/35
- https://www.vmware.com/security/advisories/VMSA-2021-0015.html
- http://packetstormsecurity.com/files/163521/VMware-ThinApp-DLL-Hijacking.html
- http://seclists.org/fulldisclosure/2021/Jul/35
- https://www.vmware.com/security/advisories/VMSA-2021-0015.html
