Exploitation Summary
CVE-2020-3950 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.
EIP tracks 4 public exploits from researchers including Metasploit, Rich Mirch, h00die, Dhanesh Kizhakkinan, Rich Mirch, jeffball <[email protected]>, grimm, including a Metasploit module exploits/osx/local/vmware_fusion_lpe.
AI-analyzed exploit summary This Metasploit module exploits a setuid binary vulnerability in VMware Fusion (CVE-2020-3950) by creating a hard link to the 'Open VMware USB Arbitrator Service' binary and replacing it with a malicious payload to achieve privilege escalation.
Description
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
Exploits (4)
This Metasploit module exploits a setuid binary vulnerability in VMware Fusion (CVE-2020-3950) by creating a hard link to the 'Open VMware USB Arbitrator Service' binary and replacing it with a malicious payload to achieve privilege escalation.
This exploit leverages a symlink vulnerability in VMware Fusion to escalate privileges by replacing a service binary with a malicious script that sets the SUID bit on a copy of bash. The attacker gains root access via the compromised service execution.
The repository contains functional exploit scripts for CVE-2020-3950, a VMware Fusion Elevation of Privilege vulnerability. The PoC script demonstrates the vulnerability by exploiting a local privilege escalation flaw.
This Metasploit module exploits a setuid binary misuse in VMware Fusion (CVE-2020-3950) to achieve local privilege escalation by manipulating the 'Open VMware USB Arbitrator Service' binary path and loading an attacker-controlled payload.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H