admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update vmware_server_side_injection_and_privilege_escalation.yml

Browse Source
This commit is contained in:
Michael Haag
2022-05-23 11:45:55 -06:00
committed by GitHub
parent 10b07d8244
commit 9546645b02
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stories/vmware_server_side_injection_and_privilege_escalation.yml
+2 -2
View File
@@ -4,9 +4,9 @@ version: 1
date: '2022-05-19'
author: Michael Haag, Splunk
description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges.
narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user.
narrative: On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user.
To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954.
Products affected by CVE-2022-22954 include - VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 – 3.3.6'
Products affected by CVE-2022-22954 include - VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 – 3.3.6
references:
- https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
- https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf