From d3d2cc4886e718f3ed5a2d990eebc166df79ed18 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 19 May 2022 15:23:12 -0600 Subject: [PATCH 1/9] vmware --- ...re_server_side_template_injection_hunt.yml | 69 +++++++++++++++++++ ...emarker_server_side_template_injection.yml | 69 +++++++++++++++++++ ...ide_injection_and_privilege_escalation.yml | 23 +++++++ ...rver_side_template_injection_hunt.test.yml | 13 ++++ ...er_server_side_template_injection.test.yml | 13 ++++ 5 files changed, 187 insertions(+) create mode 100644 detections/web/vmware_server_side_template_injection_hunt.yml create mode 100644 detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml create mode 100644 stories/vmware_server_side_injection_and_privilege_escalation.yml create mode 100644 tests/web/vmware_server_side_template_injection_hunt.test.yml create mode 100644 tests/web/vmware_workspace_one_freemarker_server_side_template_injection.test.yml diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml new file mode 100644 index 0000000000..b8e0370d04 --- /dev/null +++ b/detections/web/vmware_server_side_template_injection_hunt.yml @@ -0,0 +1,69 @@ +name: VMware Server Side Template Injection Hunt +id: 5796b570-ad12-44df-b1b5-b7e6ae3aabb0 +version: 1 +date: '2022-05-19' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Web +description: The following hunting analytic identifies the server side template injection related to CVE-2022-22954, however is a variation found within the same endpoint of the URL scheme. +search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") + Web.url="*deviceudid=*" AND Web.url IN ("*java.lang.ProcessBuilder*","*freemarker.template.utility.ObjectConstructor*") + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `vmware_server_side_template_injection_hunt_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + web or proxy logs, or ensure it is being filled by a proxy like device, into the + Web Datamodel. For additional filtering, allow list private IP space or restrict + by known good. +known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed. +references: + - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf + - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb + - https://github.com/sherlocksecurity/VMware-CVE-2022-22954 + - https://www.vmware.com/security/advisories/VMSA-2022-0011.html + - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis + - https://twitter.com/wvuuuuuuuuuuuuu/status/1519476924757778433 +tags: + analytic_story: + - VMware Server Side Injection and Privilege Escalation + asset_type: Web Server + cis20: + - CIS 3 + - CIS 5 + - CIS 16 +cve: + - CVE-2022-22954 + confidence: 50 + context: + - Scope:Network + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. + mitre_attack_id: + - T1190 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + risk_score: 49 + security_domain: network diff --git a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml new file mode 100644 index 0000000000..d886275b2e --- /dev/null +++ b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml @@ -0,0 +1,69 @@ +name: VMware Workspace ONE Freemarker Server-side Template Injection +id: 9e5726fe-8fde-460e-bd74-cddcf6c86113 +version: 1 +date: '2022-05-19' +author: Michael Haag, Splunk +type: Anomaly +datamodel: +- Web +description: The following analytic identifies the server side template injection related to CVE-2022-22954. Based on the scanning activity across the internet and proof of concept code available the template injection occurs at catalog-portal/ui/oauth/verify?error=&deviceudid=. + Upon triage, review parallel processes and VMware logs. Following the deviceudid= may be a command to be executed. Capture any file creates and review modified files on disk. +search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") + Web.url="*/catalog-portal/ui/oauth/verify?error=&deviceudid=*" AND Web.url="*freemarker.template.utility.Execute*" + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `vmware_workspace_one_freemarker_server_side_template_injection_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + web or proxy logs, or ensure it is being filled by a proxy like device, into the + Web Datamodel. For additional filtering, allow list private IP space or restrict + by known good. +known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed. +references: + - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf + - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb + - https://github.com/sherlocksecurity/VMware-CVE-2022-22954 + - https://www.vmware.com/security/advisories/VMSA-2022-0011.html + - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis +tags: + analytic_story: + - VMware Server Side Injection and Privilege Escalation + asset_type: Web Server + cis20: + - CIS 3 + - CIS 5 + - CIS 16 +cve: + - CVE-2022-22954 + confidence: 70 + context: + - Scope:Network + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. + mitre_attack_id: + - T1190 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + risk_score: 49 + security_domain: network diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml new file mode 100644 index 0000000000..5fd5d369ac --- /dev/null +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -0,0 +1,23 @@ +name: VMware Server Side Injection and Privilege Escalation +id: d6d51cc2-a092-43b7-9f61-1159943afe39 +version: 1 +date: '2022-05-19' +author: Michael Haag, Splunk +description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. +narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. + To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. + Products affected by CVE-2022-22954 include + 1. VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 \ + 1. VMware Identity Manager (vIDM) 3.3.3 – 3.3.6 \' +references: + - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis + - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf +tags: + analytic_story: VMware Server Side Injection and Privilege Escalation + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/web/vmware_server_side_template_injection_hunt.test.yml b/tests/web/vmware_server_side_template_injection_hunt.test.yml new file mode 100644 index 0000000000..391bdc5282 --- /dev/null +++ b/tests/web/vmware_server_side_template_injection_hunt.test.yml @@ -0,0 +1,13 @@ +name: VMware Server Side Template Injection Hunt Unit Test +tests: +- name: VMware Server Side Template Injection Hunt + file: web/vmware_server_side_template_injection_hunt.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: vmware_scanning_pan_threat.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log + source: pan:threat + sourcetype: pan:threat + update_timestamp: true diff --git a/tests/web/vmware_workspace_one_freemarker_server_side_template_injection.test.yml b/tests/web/vmware_workspace_one_freemarker_server_side_template_injection.test.yml new file mode 100644 index 0000000000..60df1c4ea5 --- /dev/null +++ b/tests/web/vmware_workspace_one_freemarker_server_side_template_injection.test.yml @@ -0,0 +1,13 @@ +name: VMware Workspace ONE Freemarker Server-side Template Injection Unit Test +tests: +- name: VMware Workspace ONE Freemarker Server-side Template Injection + file: web/vmware_workspace_one_freemarker_server_side_template_injection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: vmware_scanning_pan_threat.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log + source: pan:threat + sourcetype: pan:threat + update_timestamp: true From 6e010f37155c9c7ec3aef01c1110a3808a6ec83a Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 19 May 2022 15:31:08 -0600 Subject: [PATCH 2/9] tags --- detections/web/vmware_server_side_template_injection_hunt.yml | 2 +- ..._workspace_one_freemarker_server_side_template_injection.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml index b8e0370d04..572ad36780 100644 --- a/detections/web/vmware_server_side_template_injection_hunt.yml +++ b/detections/web/vmware_server_side_template_injection_hunt.yml @@ -34,7 +34,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 -cve: + cve: - CVE-2022-22954 confidence: 50 context: diff --git a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml index d886275b2e..3162fafb0d 100644 --- a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml +++ b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml @@ -34,7 +34,7 @@ tags: - CIS 3 - CIS 5 - CIS 16 -cve: + cve: - CVE-2022-22954 confidence: 70 context: From d91ff5e375c885a3bfb7398931c4f43d9e336ff7 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 23 May 2022 10:07:24 -0600 Subject: [PATCH 3/9] Update vmware_server_side_template_injection_hunt.yml --- detections/web/vmware_server_side_template_injection_hunt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml index 572ad36780..535d254d2c 100644 --- a/detections/web/vmware_server_side_template_injection_hunt.yml +++ b/detections/web/vmware_server_side_template_injection_hunt.yml @@ -65,5 +65,5 @@ tags: - Web.src - Web.dest - Web.http_user_agent - risk_score: 49 + risk_score: 35 security_domain: network From 4d1d107a7dc64fe5745f91767eb8a05c6261c2de Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 23 May 2022 10:26:01 -0600 Subject: [PATCH 4/9] Update vmware_server_side_injection_and_privilege_escalation.yml --- ...mware_server_side_injection_and_privilege_escalation.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml index 5fd5d369ac..68cf4e98df 100644 --- a/stories/vmware_server_side_injection_and_privilege_escalation.yml +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -6,9 +6,11 @@ author: Michael Haag, Splunk description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. - Products affected by CVE-2022-22954 include + Products affected by CVE-2022-22954 include \ + 1. VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 \ - 1. VMware Identity Manager (vIDM) 3.3.3 – 3.3.6 \' + + 1. VMware Identity Manager (vIDM) 3.3.3 – 3.3.6 ' references: - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf From d86c34a1a142e15a10f5b87363e6c391f8bff215 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 23 May 2022 10:54:26 -0600 Subject: [PATCH 5/9] Update vmware_server_side_injection_and_privilege_escalation.yml --- ...mware_server_side_injection_and_privilege_escalation.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml index 68cf4e98df..cf5481a6b5 100644 --- a/stories/vmware_server_side_injection_and_privilege_escalation.yml +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -6,11 +6,7 @@ author: Michael Haag, Splunk description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. - Products affected by CVE-2022-22954 include \ - - 1. VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 \ - - 1. VMware Identity Manager (vIDM) 3.3.3 – 3.3.6 ' + Products affected by CVE-2022-22954 include - VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 – 3.3.6' references: - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf From 9546645b0240fd2a5f51bb1aa447cc55db3dbfd6 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 23 May 2022 11:45:55 -0600 Subject: [PATCH 6/9] Update vmware_server_side_injection_and_privilege_escalation.yml --- .../vmware_server_side_injection_and_privilege_escalation.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml index cf5481a6b5..72d5c746cc 100644 --- a/stories/vmware_server_side_injection_and_privilege_escalation.yml +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -4,9 +4,9 @@ version: 1 date: '2022-05-19' author: Michael Haag, Splunk description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. -narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. +narrative: On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. - Products affected by CVE-2022-22954 include - VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 – 3.3.6' + Products affected by CVE-2022-22954 include - VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 – 3.3.6 references: - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf From b99430c30623016714d10292683ccfe5513f3cad Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 23 May 2022 12:35:46 -0600 Subject: [PATCH 7/9] Update vmware_server_side_injection_and_privilege_escalation.yml --- .../vmware_server_side_injection_and_privilege_escalation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml index 72d5c746cc..1733731f44 100644 --- a/stories/vmware_server_side_injection_and_privilege_escalation.yml +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. narrative: On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. - Products affected by CVE-2022-22954 include - VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 – 3.3.6 + Products affected include - VMware Workspace ONE Access (Access) 20.10.0.0 -– 20.10.0.1, 21.08.0.0 -– 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 -– 3.3.6 references: - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf From 101b027a8d25654a34879593478c190bf91159f1 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 23 May 2022 12:47:39 -0600 Subject: [PATCH 8/9] Update vmware_server_side_injection_and_privilege_escalation.yml --- .../vmware_server_side_injection_and_privilege_escalation.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml index 1733731f44..69c5e1c397 100644 --- a/stories/vmware_server_side_injection_and_privilege_escalation.yml +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -4,9 +4,9 @@ version: 1 date: '2022-05-19' author: Michael Haag, Splunk description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. -narrative: On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. +narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. - Products affected include - VMware Workspace ONE Access (Access) 20.10.0.0 -– 20.10.0.1, 21.08.0.0 -– 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 -– 3.3.6 + Products affected include - VMware Workspace ONE Access (Access) 20.10.0.0 -– 20.10.0.1, 21.08.0.0 -– 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 -– 3.3.6' references: - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf From db732d9a4c8fb20a1551ab74094d12bec507ccf3 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 23 May 2022 12:01:50 -0700 Subject: [PATCH 9/9] text update --- ...mware_server_side_injection_and_privilege_escalation.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml index 1733731f44..11e329fd9e 100644 --- a/stories/vmware_server_side_injection_and_privilege_escalation.yml +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -4,9 +4,9 @@ version: 1 date: '2022-05-19' author: Michael Haag, Splunk description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. -narrative: On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. - To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. - Products affected include - VMware Workspace ONE Access (Access) 20.10.0.0 -– 20.10.0.1, 21.08.0.0 -– 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 -– 3.3.6 +narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. + The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. + To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. Products affected include - VMware Workspace ONE Access (Access) 20.10.0.0 - 20.10.0.1, 21.08.0.0 - 21.08.0.1 and VMware Identity Manager (vIDM) 3.3.3 - 3.3.6.' references: - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf