CVE-2022-31706

What it actually does

This is a network-reachable, unauthenticated directory traversal flaw that allows an attacker to write attacker-controlled files outside the intended application path on an impacted log-management appliance. Because the target is an appliance service running with sufficient privileges to place files on the underlying operating system, arbitrary file write can be escalated to remote code execution by writing executable content, startup scripts, web-accessible server-side code, cron/systemd artifacts, or other files that are later interpreted by the operating system or application runtime. The CVSS 9.8 rating, network attack vector, no authentication requirement, and weaponized exploit maturity indicate a critical pre-authentication compromise path with potential full confidentiality, integrity, and availability impact.

Why it matters to the business

A successful exploit can give an external attacker control of a centralized logging appliance, which is especially damaging because these systems often contain sensitive operational logs, authentication events, application telemetry, and security-relevant evidence. Compromise can lead to data theft, log tampering, loss of forensic visibility, lateral movement into management networks, and disruption of monitoring operations. The high EPSS score of 0.87077 and weaponized exploit status make internet-exposed or broadly reachable instances urgent patching priorities even though the issue is not currently listed in CISA KEV. The provided affected-product metadata references nextcloud/server GIT with commit 4eca7512330808a958cbf00bbd9044ea77b3ab6b, but the vulnerability description identifies VMware vRealize Log Insight / log appliance behavior; remediation teams should verify product mapping before relying on package metadata alone.

How an attack unfolds

An attacker first identifies a reachable vulnerable log-management appliance and probes unauthenticated HTTP endpoints for file upload or file injection behavior. The attacker crafts a request containing path traversal sequences such as ../ or encoded equivalents to escape the intended destination directory. If the appliance fails to normalize and constrain the path, the payload is written to an attacker-chosen location on the operating system. The attacker then chooses a file location that causes execution, such as a web server application path, scheduled task location, service configuration path, or another interpreted runtime location. Once execution is achieved, the attacker typically runs discovery commands, establishes persistence, retrieves logs or credentials, disables or alters monitoring, and may use the appliance as a foothold for lateral movement because logging systems often have trusted network reach and access to sensitive telemetry.

How to fix it

Apply the vendor-supported fixed release or security patch for the affected log appliance immediately, prioritizing internet-facing and management-network-exposed systems. If maintaining source-based deployments using the package metadata supplied in the input, ensure nextcloud/server GIT includes commit 4eca7512330808a958cbf00bbd9044ea77b3ab6b, but validate this mapping because the CVE description and affected-package metadata appear inconsistent. Where immediate patching is not possible, restrict access to the appliance management and API interfaces to trusted administration networks only, block unauthenticated access from the internet, enforce network segmentation, and place compensating controls such as WAF rules that reject path traversal patterns in request paths, parameters, filenames, and multipart bodies. Remove any unauthorized files discovered in web roots, temporary directories, scheduler directories, service configuration paths, and application plugin or extension directories. If compromise is suspected, rebuild the appliance from trusted media after preserving forensic evidence, rotate credentials and tokens that may have appeared in logs or configuration, and verify log integrity from independent sources.

How to confirm the fix worked

Confirm the installed product version or source commit is at or above the vendor-fixed version and verify that the vulnerable code path no longer permits writing outside the intended directory. Test through an approved security validation process by sending benign traversal attempts and confirming the appliance rejects, normalizes, or confines the path without writing files. Review web/proxy logs and appliance logs to ensure traversal payloads return errors rather than successful writes. Validate that access controls restrict the management interface to approved networks. Run file integrity checks against appliance application directories, web roots, temporary directories, cron/systemd locations, plugin directories, and startup paths to ensure no unexpected files were created before or after remediation. Where available, compare hashes and package manifests against vendor baselines.

Typical attack path

1. Scan for exposed or internally reachable vulnerable log-management appliance interfaces.
2. Send unauthenticated HTTP requests to identify vulnerable file injection or upload paths.
3. Submit a crafted request containing directory traversal sequences to escape the intended write directory.
4. Write a malicious file to a location that will be executed by the application, web server, scheduler, or operating system.
5. Trigger execution of the written payload directly or wait for the target runtime to load it.
6. Establish command execution, web shell access, reverse shell access, or another remote-control mechanism.
7. Collect configuration, credentials, tokens, logs, and environment details from the appliance.
8. Tamper with logs or disable logging to reduce visibility.
9. Pivot to adjacent systems reachable from the appliance or use the host for persistence and further intrusion activity.

How to detect it

Hunt for exploitation across reverse proxy, load balancer, WAF, web server access logs, application logs, appliance system logs, EDR telemetry, file integrity monitoring, process execution logs, and network flow data. Look for unauthenticated HTTP requests containing traversal sequences in paths, query parameters, multipart filenames, or upload fields; successful POST/PUT requests followed by new files in application, web, temporary, scheduler, service, or startup directories; and unexpected execution by web server, application server, Java, Python, shell, curl, wget, nc, bash, sh, or PowerShell-like processes. Investigate any appliance process spawning operating-system commands or creating outbound connections shortly after suspicious HTTP requests. Review file creation times for suspicious artifacts around the timestamp of traversal requests. Check for deletion or truncation of appliance logs, gaps in telemetry, new cron/systemd entries, modified startup scripts, unknown JSP/war/shell files, and outbound traffic to unfamiliar hosts. Because logging appliances may contain sensitive data, also review evidence of bulk log export, configuration access, credential access, or lateral movement attempts after the initial exploit window.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /etc/cron.d/
• /etc/crontab
• /etc/systemd/system/
• /tmp/
• /var/tmp/
• /dev/shm/
• /opt/vmware/
• /usr/lib/loginsight/
• /storage/core/loginsight/
• /usr/lib/loginsight/application/
• /usr/lib/loginsight/application/3rd_party/
• /usr/lib/loginsight/application/3rd_party/apache-tomcat/
• webapps/ROOT/
• WEB-INF/
• *.jsp
• *.war
• cmd.jsp
• shell.jsp
• webshell.jsp
• bash -c
• /bin/sh -c
• curl http://
• wget http://
• nc -e
• ncat -e
• python -c
• python3 -c
• chmod +x
• crontab -e
• systemctl enable
• systemctl start

What your security team should do

• Treat this as critical for any exposed or high-trust logging appliance because exploitation is unauthenticated, weaponized, and has a high EPSS likelihood.
• Immediately inventory all deployments matching the vulnerable product description and separately validate the inconsistent affected-package metadata before closing remediation work.
• Patch or upgrade affected systems to the vendor-fixed release; for source-based tracking of the supplied package metadata, confirm inclusion of commit 4eca7512330808a958cbf00bbd9044ea77b3ab6b only after verifying applicability.
• Restrict appliance HTTP/API access to trusted administrative networks and remove direct internet exposure.
• Deploy temporary detection or blocking rules for path traversal sequences in request URI, query string, filename, and multipart upload fields.
• Hunt retrospectively through web, reverse proxy, WAF, EDR, appliance, and file-integrity logs for traversal attempts, unexpected file writes, suspicious child processes, and log tampering.
• If evidence of exploitation exists, preserve forensic images and logs, rebuild the appliance from a trusted source, rotate exposed secrets, and review downstream systems for lateral movement.
• Monitor for post-exploitation behavior such as web shells, reverse shells, new scheduled tasks, unexpected service changes, unusual outbound connections, and deletion or modification of log files.