CVE-2023-20854
📋 TL;DR
CVE-2023-20854 is an arbitrary file deletion vulnerability in VMware Workstation that allows local authenticated users to delete any files on the system where Workstation is installed. This affects users running vulnerable versions of VMware Workstation on their local machines.
💻 Affected Systems
- VMware Workstation
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, leading to OS corruption, data loss, or denial of service.
Likely Case
Targeted deletion of user files, configuration files, or application data causing data loss and service disruption.
If Mitigated
Limited impact if proper access controls and monitoring are in place, with potential for detection before significant damage.
🎯 Exploit Status
Exploitation requires local user access but no special privileges beyond what normal users have.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: VMware Workstation 17.0.2
Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2023-0003.html
Restart Required: Yes
Instructions:
1. Download VMware Workstation 17.0.2 from VMware website. 2. Run the installer. 3. Follow installation prompts. 4. Restart system when prompted.
🔧 Temporary Workarounds
Restrict local user access
allLimit which users have access to systems running VMware Workstation
Implement file integrity monitoring
allMonitor for unauthorized file deletions using tools like Tripwire or Windows File Integrity Monitoring
🧯 If You Can't Patch
- Implement strict access controls to limit who can use VMware Workstation
- Deploy file integrity monitoring to detect unauthorized file deletions
🔍 How to Verify
Check if Vulnerable:
Check VMware Workstation version via Help > About in the application or check installed version in Programs and Features (Windows) or package manager (Linux).Check Version:
On Windows: wmic product where name='VMware Workstation' get version. On Linux: vmware --versionVerify Fix Applied:
Verify version is 17.0.2 or later in Help > About or system information.📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events in system logs
- VMware Workstation error logs showing abnormal file operations
Network Indicators:
- No network indicators - local exploit only
SIEM Query:
EventID=4663 (File deletion) AND ProcessName contains 'vmware' AND User NOT IN (authorized_users_list)