mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
vmware
This commit is contained in:
mhaag-spl
@@ -0,0 +1,69 @@
|
||||
name: VMware Server Side Template Injection Hunt
|
||||
id: 5796b570-ad12-44df-b1b5-b7e6ae3aabb0
|
||||
version: 1
|
||||
date: '2022-05-19'
|
||||
author: Michael Haag, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Web
|
||||
description: The following hunting analytic identifies the server side template injection related to CVE-2022-22954, however is a variation found within the same endpoint of the URL scheme.
|
||||
search: '| tstats count from datamodel=Web where Web.http_method IN ("GET")
|
||||
Web.url="*deviceudid=*" AND Web.url IN ("*java.lang.ProcessBuilder*","*freemarker.template.utility.ObjectConstructor*")
|
||||
by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype
|
||||
| `drop_dm_object_name("Web")`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `vmware_server_side_template_injection_hunt_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
web or proxy logs, or ensure it is being filled by a proxy like device, into the
|
||||
Web Datamodel. For additional filtering, allow list private IP space or restrict
|
||||
by known good.
|
||||
known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
|
||||
references:
|
||||
- https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf
|
||||
- https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb
|
||||
- https://github.com/sherlocksecurity/VMware-CVE-2022-22954
|
||||
- https://www.vmware.com/security/advisories/VMSA-2022-0011.html
|
||||
- https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
|
||||
- https://twitter.com/wvuuuuuuuuuuuuu/status/1519476924757778433
|
||||
tags:
|
||||
analytic_story:
|
||||
- VMware Server Side Injection and Privilege Escalation
|
||||
asset_type: Web Server
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
cve:
|
||||
- CVE-2022-22954
|
||||
confidence: 50
|
||||
context:
|
||||
- Scope:Network
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred.
|
||||
mitre_attack_id:
|
||||
- T1190
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- Web.http_method
|
||||
- Web.url
|
||||
- Web.url_length
|
||||
- Web.src
|
||||
- Web.dest
|
||||
- Web.http_user_agent
|
||||
risk_score: 49
|
||||
security_domain: network
|
||||
@@ -0,0 +1,69 @@
|
||||
name: VMware Workspace ONE Freemarker Server-side Template Injection
|
||||
id: 9e5726fe-8fde-460e-bd74-cddcf6c86113
|
||||
version: 1
|
||||
date: '2022-05-19'
|
||||
author: Michael Haag, Splunk
|
||||
type: Anomaly
|
||||
datamodel:
|
||||
- Web
|
||||
description: The following analytic identifies the server side template injection related to CVE-2022-22954. Based on the scanning activity across the internet and proof of concept code available the template injection occurs at catalog-portal/ui/oauth/verify?error=&deviceudid=.
|
||||
Upon triage, review parallel processes and VMware logs. Following the deviceudid= may be a command to be executed. Capture any file creates and review modified files on disk.
|
||||
search: '| tstats count from datamodel=Web where Web.http_method IN ("GET")
|
||||
Web.url="*/catalog-portal/ui/oauth/verify?error=&deviceudid=*" AND Web.url="*freemarker.template.utility.Execute*"
|
||||
by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype
|
||||
| `drop_dm_object_name("Web")`
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `vmware_workspace_one_freemarker_server_side_template_injection_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
web or proxy logs, or ensure it is being filled by a proxy like device, into the
|
||||
Web Datamodel. For additional filtering, allow list private IP space or restrict
|
||||
by known good.
|
||||
known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
|
||||
references:
|
||||
- https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf
|
||||
- https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb
|
||||
- https://github.com/sherlocksecurity/VMware-CVE-2022-22954
|
||||
- https://www.vmware.com/security/advisories/VMSA-2022-0011.html
|
||||
- https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
|
||||
tags:
|
||||
analytic_story:
|
||||
- VMware Server Side Injection and Privilege Escalation
|
||||
asset_type: Web Server
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 5
|
||||
- CIS 16
|
||||
cve:
|
||||
- CVE-2022-22954
|
||||
confidence: 70
|
||||
context:
|
||||
- Scope:Network
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred.
|
||||
mitre_attack_id:
|
||||
- T1190
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- Web.http_method
|
||||
- Web.url
|
||||
- Web.url_length
|
||||
- Web.src
|
||||
- Web.dest
|
||||
- Web.http_user_agent
|
||||
risk_score: 49
|
||||
security_domain: network
|
||||
@@ -0,0 +1,23 @@
|
||||
name: VMware Server Side Injection and Privilege Escalation
|
||||
id: d6d51cc2-a092-43b7-9f61-1159943afe39
|
||||
version: 1
|
||||
date: '2022-05-19'
|
||||
author: Michael Haag, Splunk
|
||||
description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges.
|
||||
narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user.
|
||||
To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954.
|
||||
Products affected by CVE-2022-22954 include
|
||||
1. VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 \
|
||||
1. VMware Identity Manager (vIDM) 3.3.3 – 3.3.6 \'
|
||||
references:
|
||||
- https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
|
||||
- https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf
|
||||
tags:
|
||||
analytic_story: VMware Server Side Injection and Privilege Escalation
|
||||
category:
|
||||
- Adversary Tactics
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
usecase: Advanced Threat Detection
|
||||
@@ -0,0 +1,13 @@
|
||||
name: VMware Server Side Template Injection Hunt Unit Test
|
||||
tests:
|
||||
- name: VMware Server Side Template Injection Hunt
|
||||
file: web/vmware_server_side_template_injection_hunt.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: vmware_scanning_pan_threat.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log
|
||||
source: pan:threat
|
||||
sourcetype: pan:threat
|
||||
update_timestamp: true
|
||||
@@ -0,0 +1,13 @@
|
||||
name: VMware Workspace ONE Freemarker Server-side Template Injection Unit Test
|
||||
tests:
|
||||
- name: VMware Workspace ONE Freemarker Server-side Template Injection
|
||||
file: web/vmware_workspace_one_freemarker_server_side_template_injection.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: vmware_scanning_pan_threat.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log
|
||||
source: pan:threat
|
||||
sourcetype: pan:threat
|
||||
update_timestamp: true
|
||||
Reference in New Issue
Block a user