Two critical vulnerabilities in the VMware Guest Authentication Service (VGAuth) component of VMware Tools allow local attackers to escalate privileges from any user account to SYSTEM-level access on Windows virtual machines. CVE-2025-22247 received remediation in VMware Tools 12.5.2 on May 12, 2025, introducing input validation to reject usernames containing unsafe path traversal characters, runtime path validation using GetFinalPathNameByHandleW, and a new allowSymlinks configuration flag defaulting to false. CVE-2025-22230 was patched in VMware Tools 12.5.1 released on March 25, 2025, implementing randomized private pipe names with UUID suffixes and enforcing the FILE_FLAG_FIRST_PIPE_INSTANCE flag to prevent hijacking attacks. PT SWARM reports that the VGAuth service creates user-specific private pipes using predictable naming conventions (\.\pipe\vgauth-service-<username>) without the FILE_FLAG_FIRST_PIPE_INSTANCE flag, allowing low-privileged attackers to create malicious pipes before the service does. By combining junction mount points with DOS device symlinks, and utilizing Opportunistic Locks for precise timing, attackers can redirect file operations to privileged system locations such as C:\Windows\System32, enabling DLL hijacking for SYSTEM-level code execution. Once authenticated as SYSTEM, attackers gain access to certificate alias stores, ticket validation mechanisms, and SAML authentication tokens for privilege escalation. The QueryAliases and RemoveAlias operations accept unsanitized username parameters, enabling path traversal attacks using sequences like “../../../../../../evil” to break out of the intended C:\ProgramData\VMware\VMware VGAuth\aliasStore directory. When the service attempts to create the pipe for SYSTEM authentication, it unknowingly uses the attacker-controlled pipe, effectively granting superuser privileges within the VGAuth protocol. The vulnerabilities, tracked as CVE-2025-22230 and CVE-2025-22247, affect VMware Tools installations across ESXi-managed environments and standalone VMware Workstation deployments. Security researcher Sergey Bliznyuk demonstrated how attackers can exploit this by creating a named pipe at \.\pipe\vgauth-service-system with permissive access controls.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Jul 2025 13:20:18 +0000