CVE-2022-22954criticalunder attackransomwareCWE-94

CVE-2022-22954: critical vulnerability in VMware Workspace ONE Access and Identity Manager

Published · Updated

Follow this CVE+ Monitor Workspace ONE Access and Identity Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDApr 11
1st PoCOct 1
metasploitApr 6
CISA KEV+3d
Action required by CISAfederal deadline: 2022-05-05

Apply updates per vendor instructions.

In short

VMware Workspace ONE Access and Identity Manager have a flaw that allows remote code execution through template injection. An attacker on the network can exploit this to run malicious code on the server.

Technical detail

Server-side template injection vulnerability in VMware Workspace ONE Access and Identity Manager allows unauthenticated remote code execution (CVSS 9.8). The vulnerability stems from improper input validation in template processing, enabling attackers with network access to inject malicious template directives that execute arbitrary code with server privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · VMware Workspace ONE Access and Identity Manager
public PoCs found — 48
githubgithub.com/Schira4396/VcenterKiller★ 1475githubgithub.com/sherlocksecurity/VMware-CVE-2022-22954★ 279githubgithub.com/bewhale/CVE-2022-22954★ 68githubgithub.com/tunelko/CVE-2022-22954-PoC★ 16githubgithub.com/jax7sec/CVE-2022-22954★ 12githubgithub.com/Vulnmachines/VMWare_CVE-2022-22954★ 11githubgithub.com/DrorDvash/CVE-2022-22954_VMware_PoC★ 10githubgithub.com/orwagodfather/CVE-2022-22954★ 8githubgithub.com/b4dboy17/CVE-2022-22954★ 5githubgithub.com/aniqfakhrul/CVE-2022-22954★ 4githubgithub.com/MLX15/CVE-2022-22954★ 4githubgithub.com/Chocapikk/CVE-2022-22954★ 4githubgithub.com/axingde/CVE-2022-22954-POC★ 2githubgithub.com/corelight/cve-2022-22954★ 1githubgithub.com/MSeymenD/CVE-2022-22954-Testi★ 1githubgithub.com/emilyastranova/VMware-CVE-2022-22954-Command-Injector★ 1githubgithub.com/mumu2020629/-CVE-2022-22954-scanner★ 1githubgithub.com/amit-pathak009/CVE-2022-22954-PoC★ 0githubgithub.com/nguyenv1nK/CVE-2022-22954★ 0githubgithub.com/secfb/CVE-2022-22954★ 0githubgithub.com/arzuozkan/CVE-2022-22954★ 0githubgithub.com/amit-pathak009/CVE-2022-22954★ 0githubgithub.com/Jun-5heng/CVE-2022-22954★ 0githubgithub.com/lucksec/VMware-CVE-2022-22954★ 0githubgithub.com/mhurts/CVE-2022-22954-POC★ 0vulncheckvulncheck.com/xdb/5f6e9e67dd01unverifiedvulncheckvulncheck.com/xdb/ccedf295370aunverifiedvulncheckvulncheck.com/xdb/42035119a4ccunverifiedvulncheckvulncheck.com/xdb/553e7fa2ed2bunverifiedvulncheckvulncheck.com/xdb/c5d30f0543d0unverifiedvulncheckvulncheck.com/xdb/73c52cb71fcaunverifiedvulncheckvulncheck.com/xdb/fc30bfa57beaunverifiedvulncheckvulncheck.com/xdb/1c13d786fae1unverifiedvulncheckvulncheck.com/xdb/52b74302fa5eunverifiedvulncheckvulncheck.com/xdb/63868930e1a7unverifiedvulncheckvulncheck.com/xdb/ae58b5d4e845unverifiedvulncheckvulncheck.com/xdb/749c63cbbb99unverifiedvulncheckvulncheck.com/xdb/5084244e5a1eunverifiedvulncheckvulncheck.com/xdb/2cfe76b93e37unverifiedcve_referencepacketstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/3cac1b8f8b74unverifiedvulncheckvulncheck.com/xdb/e1e21d39f7edunverifiedvulncheckvulncheck.com/xdb/2184ae956a90unverifiedvulncheckvulncheck.com/xdb/eb9450cfb07aunverifiedvulncheckvulncheck.com/xdb/c9ec81500cf0unverifiedvulncheckvulncheck.com/xdb/13023d4a2d10unverifiedvulncheckvulncheck.com/xdb/3129d733dec5unverifiedvulncheckvulncheck.com/xdb/c0ce39475b18unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.