Executive Summary

A directory traversal vulnerability was discovered in VMware Avi Load Balancer, which allows malicious, authenticated network users to perform directory traversal attacks. The vulnerability has a CVSS score of 8.8, indicating high severity. Multiple versions of the product are affected.

Technical Analysis

The vulnerability is classified as a directory traversal issue (CWE-22). It is caused by flaws in file path validation, which allow an attacker to traverse directories. The attack vector is network-based, with low attack complexity and low privileges required. The vulnerability affects the following versions:
  • 32.1.1 (fixed in 32.1.2)
  • 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3)
  • 30.1.1 through 30.2.6 (fixed in 30.2.7)
  • 22.1.1 through 22.1.7 (fixed in 30.2.7)

How It Gets Exploited

An authenticated network user with low privileges can exploit this vulnerability by sending a crafted request to the Avi Load Balancer. The attacker would need to manipulate file path parameters to traverse directories. For example, an attacker might send a request with a filename parameter that includes directory traversal characters (e.g., ../), which would allow them to access files outside the intended directory. If successful, the attacker could potentially access sensitive files, achieve code execution, or perform other malicious actions.

Impact Assessment

The vulnerability has a CVSS score of 8.8, indicating high severity. An attacker who exploits this vulnerability could achieve high impact on confidentiality, integrity, and availability. The blast radius is significant, as an attacker could potentially access sensitive data or disrupt critical systems.

Recommended Actions

To mitigate this vulnerability, update VMware Avi Load Balancer to the following versions:
  • 32.1.2 or later
  • 31.2.2-2p3 or later
  • 30.2.7 or later
Additionally, implement network segmentation and access controls to limit the attack surface. Monitor for suspicious activity and implement a web application firewall (WAF) to detect and prevent directory traversal attacks.

Sources

  • National Vulnerability Database (NVD)
  • VMware Security Advisory