How Do CVE-2025-22230 and CVE-2025-22247 in VMware Tools Give SYSTEM Access? Full Exploit Breakdown and Patch Guide

Table of Contents

• Introduction: What Are the VMware VGAuth Vulnerabilities About?
• What Is VGAuth in VMware Tools?
• Breakdown of the Two Critical VMware Vulnerabilities
• CVE Summary of VMware VGAuth Vulnerabilities
• How Were the Vulnerabilities Exploited?
• What Patches Did Broadcom Release?
• Why Are These VGAuth Flaws So Dangerous?
• Who Is Affected?
• How Can Students and Professionals Learn to Defend Against These Attacks?
• Conclusion
• Frequently Asked Questions (FAQs)

Introduction: What Are the VMware VGAuth Vulnerabilities About?

On July 25, 2025, two critical vulnerabilities were disclosed in the VMware Tools VGAuth component, affecting both ESXi virtual environments and VMware Workstation. These flaws—tracked as CVE-2025-22230 and CVE-2025-22247—allow local attackers to escalate privileges to SYSTEM level on Windows virtual machines.

Discovered by researchers at PT SWARM and Sergey Bliznyuk, these issues exploit poor pipe handling and insecure file operations in the VGAuth service, granting full control over the host system. Organizations are urged to upgrade to VMware Tools 12.5.2 or higher to prevent exploitation.

What Is VGAuth in VMware Tools?

VGAuth (VMware Guest Authentication Service) is a critical component in VMware Tools that allows authentication communication between host and guest systems. It manages secure tokens, alias certificates, and user validation between the hypervisor and the virtual machine.

However, the named pipe interface and alias store management used by VGAuth in Windows guest VMs introduced unintended attack surfaces for local privilege escalation (LPE).

Breakdown of the Two Critical VMware Vulnerabilities

 CVE-2025-22230 – Named Pipe Hijacking (Authentication Bypass)

• Severity: High (CVSS 7.8)

• Affected Version: VMware Tools 12.5.0

• Patched Version: VMware Tools 12.5.1

This flaw occurs because VGAuth creates named pipes using predictable names (e.g., \\.\pipe\vgauth-service-) without securing exclusive creation rights.

Attack Flow:

1. An attacker pre-creates a malicious pipe (e.g., \\.\pipe\vgauth-service-system).

2. VGAuth unknowingly connects to the attacker-controlled pipe.

3. The attacker is authenticated as SYSTEM within VGAuth’s protocol.

4. They now access:

   • Certificate alias stores

   • SAML tokens

   • Ticket validation systems

This leads to full SYSTEM privilege escalation.

CVE-2025-22247 – Path Traversal in Alias Store Management

• Severity: Medium (CVSS 6.1)

• Affected Version: VMware Tools 12.5.0

• Patched Version: VMware Tools 12.5.2

The second issue arises in VGAuth’s alias management functions (QueryAliases and RemoveAlias). These accept unsanitized user input, making them vulnerable to path traversal like ../../../../evil.

Attack Vector:

• Combine symbolic link manipulation with TOCTOU attacks

• Redirect operations to privileged areas like:

  • C:\Windows\System32

  • System DLL directories

• Result: DLL hijacking and arbitrary file operations as SYSTEM

CVE Summary of VMware VGAuth Vulnerabilities

How Were the Vulnerabilities Exploited?

Real-World Demonstration

Security researcher Sergey Bliznyuk demonstrated how to create a named pipe as SYSTEM with permissive ACLs. When VGAuth attempted to create a pipe, it would connect to the existing malicious one—bypassing all authentication checks.

The second CVE used:

• DOS device symlinks

• Opportunistic Locks

• Mount point redirection
  to reroute VGAuth’s alias store operations and perform DLL drops into system folders.

What Patches Did Broadcom Release?

Broadcom, now owning VMware, issued the following fixes:

VMware Tools 12.5.1 (March 25, 2025)

• Randomized named pipe names using UUID suffixes

• Added FILE_FLAG_FIRST_PIPE_INSTANCE to block hijack attempts

VMware Tools 12.5.2 (May 12, 2025)

• Rejected usernames with ../ traversal characters

• Used GetFinalPathNameByHandleW for path resolution

• Introduced allowSymlinks setting (default: false)

Why Are These VGAuth Flaws So Dangerous?

These vulnerabilities are particularly dangerous for:

• Virtualized enterprise environments

• High-security Windows VMs

• Cloud-based virtual desktops

The fact that any local user can become SYSTEM using predictable behaviors in an authentication module is a devastating misconfiguration—one that bypasses the need for malware or external exploitation.

Who Is Affected?

Organizations running:

• VMware Workstation on Windows

• VMs on ESXi with VMware Tools 12.5.0

• Legacy Windows guest OS environments

They must verify whether:

• VGAuth is active

• Alias management is enabled

• VMware Tools is 12.5.0 or older

How Can Students and Professionals Learn to Defend Against These Attacks?

If you're a student, cybersecurity learner, or IT admin, this case is a perfect hands-on scenario to explore:

• Named Pipe Exploitation

• Privilege Escalation Tactics

• TOCTOU race conditions

• Windows symbolic link attacks

 Enroll in our Advanced Penetration Testing or Windows Exploitation courses to learn how to:

• Recreate this attack in lab environments

• Understand Windows internals

• Secure guest services like VGAuth

Conclusion: What Does This Mean for the Future of Virtual Security?

As virtualization and cloud-based workspaces grow, even low-level service flaws like VGAuth can expose entire ecosystems. This incident reminds us that authentication systems must be hardened, especially when involving OS-level interactions like named pipes or file access.

FAQs:

What is CVE-2025-22230 in VMware Tools?

A critical authentication bypass vulnerability using named pipe hijacking in the VGAuth component.

What is CVE-2025-22247 in VMware Tools?

A path traversal vulnerability in VGAuth's alias store management functions, allowing file system manipulation.

How do these vulnerabilities affect VMware Tools?

They enable local users to escalate privileges to SYSTEM on Windows virtual machines.

What is VGAuth in VMware Tools?

VGAuth is the VMware Guest Authentication Service used for secure communication between host and guest systems.

What environments are impacted by the VGAuth flaws?

Both VMware Workstation and ESXi-managed Windows VMs running VMware Tools 12.5.0.

What causes the CVE-2025-22230 vulnerability?

Failure to use the FILE_FLAG_FIRST_PIPE_INSTANCE during named pipe creation, enabling attackers to hijack authentication.

How is SYSTEM access gained via named pipe hijacking?

Attackers create a pipe before VGAuth does, tricking the service into authenticating them as SYSTEM.

What naming pattern made pipes predictable in VGAuth?

Pipes were named as \\.\pipe\vgauth-service-, allowing pre-creation by attackers.

What does the VGAuth protocol grant access to once bypassed?

Certificate alias stores, ticket validation mechanisms, and SAML authentication tokens.

How was CVE-2025-22230 mitigated?

By randomizing pipe names with UUIDs and enforcing the FILE_FLAG_FIRST_PIPE_INSTANCE flag in version 12.5.1.

How does CVE-2025-22247 work?

It uses unsanitized input in alias store operations, allowing attackers to traverse paths and manipulate system files.

What file operations were vulnerable to redirection?

QueryAliases and RemoveAlias accepted unsafe input that could point to system directories.

What techniques were used to exploit CVE-2025-22247?

DOS symlinks, mount point redirection, and opportunistic locks for timing the attack.

What could attackers achieve using CVE-2025-22247?

They could perform DLL hijacking and write/delete files in privileged directories like System32.

What version fixes CVE-2025-22230?

VMware Tools version 12.5.1.

What version fixes CVE-2025-22247?

VMware Tools version 12.5.2.

When were the patches for these vulnerabilities released?

March 25, 2025 for CVE-2025-22230 and May 12, 2025 for CVE-2025-22247.

Who discovered the VMware Tools vulnerabilities?

Researchers at PT SWARM and Sergey Bliznyuk.

What is the severity of CVE-2025-22230?

High severity with a CVSS score of 7.8.

What is the severity of CVE-2025-22247?

Medium severity with a CVSS score of 6.1.

Why is named pipe hijacking dangerous?

It allows attackers to impersonate privileged users and bypass authentication mechanisms.

How does path traversal aid privilege escalation?

By manipulating paths, attackers can access or modify protected system locations.

Is DLL hijacking possible with these flaws?

Yes, especially via the CVE-2025-22247 vulnerability by redirecting file writes to System32.

What is the allowSymlinks flag introduced in VMware Tools?

A new configuration option to prevent symlink abuse; it defaults to false.

What tools or APIs were used in patching the path traversal bug?

GetFinalPathNameByHandleW was used to verify actual file paths at runtime.

Are Linux or non-Windows guests affected?

These vulnerabilities are specific to Windows guest VMs.

Do these flaws require remote access?

No, they are local privilege escalation vulnerabilities.

Can attackers exploit these bugs without admin access?

Yes, even low-privileged local users can exploit these flaws.

Should enterprises update immediately?

Yes, organizations should update to VMware Tools 12.5.2 or newer right away.

How can students learn from this case?

By studying named pipe hijacking, TOCTOU attacks, and symbolic link abuse in sandboxed environments.