Techzone/VMware Horizon

VMware Horizon

3 min readArticle

VMware Horizon is a Virtual Desktop Infrastructure (VDI) and application delivery platform. It lets organizations deliver Windows/Linux desktops and applications to users from a centralized data center — users get a full desktop experience on any device (thin clients, laptops, tablets) without a powerful local machine.

What It Is

Instead of each user having a PC with Windows installed locally, Horizon runs desktops as VMs in the data center. Users connect remotely using the Horizon Client over a display protocol (Blast Extreme or PCoIP). From the user's perspective, it looks and feels like a normal desktop.

Architecture Components

Component Role
Connection Server Broker — authenticates users, routes connections
ESXi Hosts Run the desktop VMs
vCenter Server Manages the ESXi hosts and VM pool
Horizon Agent Installed in each desktop VM
Horizon Client End-user app to connect to their desktop
Unified Access Gateway (UAG) Edge gateway for external access
App Volumes Application layering (apps delivered on top of base image)
Dynamic Environment Manager (DEM) User profile management

Display Protocols

  • Blast Extreme — HTTP/WebSocket based, works over HTML5, adaptive compression
  • PCoIP — UDP-based, Teradici technology, older but widely deployed

Types of Desktop Pools

  • Floating — users get any available desktop from the pool; resets after logout
  • Dedicated — each user is permanently assigned their own VM
  • Instant Clone — fast provisioning; desktops are clones of a parent VM created instantly
  • Published (RDSH) — shared session desktops on Windows Server (like RDS)

Security Relevance

Attack Surface

  • Horizon Connection Server — frequently targeted; has had critical CVEs (e.g., Log4Shell in 2021 hit Horizon hard because it used Log4j)
  • UAG / External Access — public-facing, high-value target
  • Lateral movement — compromising one Horizon server can give access to all VDI desktops

Critical CVEs in Horizon

  • CVE-2021-44228 (Log4Shell) — Horizon Connection Server was affected; required emergency patching
  • Multiple CVEs in 2022-2023 related to authentication bypass and SSRF
  • Always check Broadcom/VMware security advisories

What to Check in Assessments

bash 
# Check if Horizon Connection Server is exposed
nmap -sV -p 443,8443,80 horizon.company.com

# Check HTTP response headers for version info
curl -kI https://horizon.company.com/portal/

# Default admin URL
https://horizon-server/admin

# Check for unauthenticated endpoints
curl -k https://horizon-server/SAML/metadata

Horizon Client

bash 
# Linux client
sudo apt install vmware-horizon-client

# Connect via command line
vmware-view vmware-view://connection-server/desktopname

Common Admin Tasks (via Horizon Console)

shell 
1. Login to https://connection-server/admin
2. Pool management: Infrastructure → Desktops and Applications → Desktop Pools
3. Check capacity: Monitor → Dashboard
4. User assignments: Inventory → Users and Groups
5. Event monitoring: Monitor → Events

Patching Priority

Horizon is a high-value target. When VMware/Broadcom releases security patches for Horizon:

  • Treat as critical — patch within 48 hours for internet-facing deployments
  • Check if Log4j (or any embedded component) is affected
  • UAG should be updated independently from Connection Server

See Also

  • vmware-esxi-guide - The underlying hypervisor
  • future-of-tech-emerging-trends-2023 - VMware overview
  • vmware-workstation-guide - Desktop VM alternative
techzonesite.comUnlock Your IT Potential