⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-05-05.

CVE-2022-22954 — Code Injection in Vmware Cloud Foundation

CWE-94 — Code Injection18 documents12 sources
Severity
9.8CRITICALNVD
EPSS
94.4%
top < 0.01%
CISA KEV
KEVRansomware
Added 2022-04-14
Due 2022-05-05
Exploit
Exploited in wild
Active exploitation observed
Affected products
5
Vmware Cloud FoundationVmware Vrealize Suite Lifecycle ManagerVmware Identity Manager+2 more
Timeline
PublishedApr 11
KEV addedApr 14
KEV dueMay 5
Latest updateOct 21
CISA Required Action: Apply updates per vendor instructions.

Description

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶NVDvmware/workspace_one_access4 versions+3
▶NVDvmware/identity_manager4 versions+3
▶NVDvmware/cloud_foundation4.0 — 4.3.1

🔴Vulnerability Details

3
GHSA
GHSA-q7xc-35g4-g566: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection↗2022-04-12
▶
CVEList
CVE-2022-22954: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection↗2022-04-11
▶
VulnCheck
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability↗2022
▶

💥Exploits & PoCs

2
Nuclei
VMware Workspace ONE Access - Server-Side Template Injection
▶
Metasploit
VMware Workspace ONE Access CVE-2022-22954↗
▶

🔍Detection Rules

4
Suricata
ET EXPLOIT Possible VMware Workspace ONE Access RCE via Server-Side Template Injection Inbound (CVE-2022-22954)↗2022-04-29
▶
Suricata
ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)↗2022-04-08
▶
Suricata
ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)↗2022-04-08
▶
Suricata
ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)↗2022-04-08
▶

📋Vendor Advisories

2
CISA
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability↗2022-04-14
▶
VMware
VMware Workspace ONE Access, Identity Manager and vRealize Automation updates address multiple vulnerabilities.↗2022-04-06
▶

🕵️Threat Intelligence

4
Fortinet
Mirai, RAR1Ransom, and GuardMiner – Multiple Malware Campaigns Target VMware Vulnerability↗2022-10-21
▶
Unit42
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More↗2022-08-19
▶
Unit42
Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)↗2022-05-20
▶
Unit42
Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)↗2022-05-20
▶

💬Community

2
HackerOne
██████████ vulnerable to CVE-2022-22954↗2022-04-29
▶
HackerOne
███ vulnerable to CVE-2022-22954↗2022-04-20
▶
CVE-2022-22954 — Code Injection in Vmware | cvebase