CVE-2022-21817
📋 TL;DR
This CVE describes a Cross-Origin Resource Sharing (CORS) vulnerability in NVIDIA Omniverse Launcher that allows an unprivileged remote attacker to steal access tokens by tricking a user into visiting a malicious website. If exploited, it can lead to unauthorized access to resources across security domains, potentially resulting in code execution, privilege escalation, and breaches of confidentiality and integrity. Users of vulnerable NVIDIA Omniverse Launcher versions are affected.
💻 Affected Systems
- NVIDIA Omniverse Launcher
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full control over the affected system, executes arbitrary code, escalates privileges to administrator level, and compromises sensitive data across security domains.
Likely Case
An attacker steals access tokens to access restricted resources, leading to data theft, unauthorized actions, and potential lateral movement within the network.
If Mitigated
With proper controls like patching and network segmentation, impact is limited to isolated incidents with minimal data exposure and no privilege escalation.
🎯 Exploit Status
Exploitation requires user interaction (browsing a malicious site) but is straightforward once initiated, leveraging CORS misconfigurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Specific version not listed; refer to NVIDIA advisory for latest patched release.
Vendor Advisory: https://nvidia.custhelp.com/app/answers/detail/a_id/5318
Restart Required: Yes
Instructions:
1. Visit the NVIDIA advisory URL. 2. Download and install the latest version of NVIDIA Omniverse Launcher. 3. Restart the system to apply changes.
🔧 Temporary Workarounds
Disable or Restrict Launcher Usage
allTemporarily disable the NVIDIA Omniverse Launcher or restrict user access to prevent exploitation until patching is possible.
🧯 If You Can't Patch
- Implement network segmentation to isolate affected systems and limit access to critical resources.
- Educate users to avoid browsing untrusted websites and enable browser security features like strict CORS policies.
🔍 How to Verify
Check if Vulnerable:
Check the installed version of NVIDIA Omniverse Launcher against the patched version listed in the NVIDIA advisory.Check Version:
On Windows: Check via 'Programs and Features' in Control Panel. On Linux: Use package manager commands like 'dpkg -l' or 'rpm -qa' for NVIDIA Omniverse.Verify Fix Applied:
Confirm that the launcher version matches or exceeds the patched version from the advisory and test for CORS vulnerabilities using security tools.📡 Detection & Monitoring
Log Indicators:
- Unusual access token requests or CORS-related errors in application logs
- Failed authentication attempts from unexpected origins
Network Indicators:
- Suspicious HTTP requests with CORS headers to NVIDIA Omniverse endpoints
- Traffic from known malicious IPs to launcher services
SIEM Query:
Example: 'source="nvidia_omniverse" AND (event="CORS_violation" OR status="401")'