diff --git a/detections/web/vmware_server_side_template_injection_hunt.yml b/detections/web/vmware_server_side_template_injection_hunt.yml new file mode 100644 index 0000000000..b8e0370d04 --- /dev/null +++ b/detections/web/vmware_server_side_template_injection_hunt.yml @@ -0,0 +1,69 @@ +name: VMware Server Side Template Injection Hunt +id: 5796b570-ad12-44df-b1b5-b7e6ae3aabb0 +version: 1 +date: '2022-05-19' +author: Michael Haag, Splunk +type: Hunting +datamodel: +- Web +description: The following hunting analytic identifies the server side template injection related to CVE-2022-22954, however is a variation found within the same endpoint of the URL scheme. +search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") + Web.url="*deviceudid=*" AND Web.url IN ("*java.lang.ProcessBuilder*","*freemarker.template.utility.ObjectConstructor*") + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `vmware_server_side_template_injection_hunt_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + web or proxy logs, or ensure it is being filled by a proxy like device, into the + Web Datamodel. For additional filtering, allow list private IP space or restrict + by known good. +known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed. +references: + - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf + - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb + - https://github.com/sherlocksecurity/VMware-CVE-2022-22954 + - https://www.vmware.com/security/advisories/VMSA-2022-0011.html + - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis + - https://twitter.com/wvuuuuuuuuuuuuu/status/1519476924757778433 +tags: + analytic_story: + - VMware Server Side Injection and Privilege Escalation + asset_type: Web Server + cis20: + - CIS 3 + - CIS 5 + - CIS 16 +cve: + - CVE-2022-22954 + confidence: 50 + context: + - Scope:Network + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. + mitre_attack_id: + - T1190 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + risk_score: 49 + security_domain: network diff --git a/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml new file mode 100644 index 0000000000..d886275b2e --- /dev/null +++ b/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml @@ -0,0 +1,69 @@ +name: VMware Workspace ONE Freemarker Server-side Template Injection +id: 9e5726fe-8fde-460e-bd74-cddcf6c86113 +version: 1 +date: '2022-05-19' +author: Michael Haag, Splunk +type: Anomaly +datamodel: +- Web +description: The following analytic identifies the server side template injection related to CVE-2022-22954. Based on the scanning activity across the internet and proof of concept code available the template injection occurs at catalog-portal/ui/oauth/verify?error=&deviceudid=. + Upon triage, review parallel processes and VMware logs. Following the deviceudid= may be a command to be executed. Capture any file creates and review modified files on disk. +search: '| tstats count from datamodel=Web where Web.http_method IN ("GET") + Web.url="*/catalog-portal/ui/oauth/verify?error=&deviceudid=*" AND Web.url="*freemarker.template.utility.Execute*" + by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype + | `drop_dm_object_name("Web")` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `vmware_workspace_one_freemarker_server_side_template_injection_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + web or proxy logs, or ensure it is being filled by a proxy like device, into the + Web Datamodel. For additional filtering, allow list private IP space or restrict + by known good. +known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed. +references: + - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf + - https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb + - https://github.com/sherlocksecurity/VMware-CVE-2022-22954 + - https://www.vmware.com/security/advisories/VMSA-2022-0011.html + - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis +tags: + analytic_story: + - VMware Server Side Injection and Privilege Escalation + asset_type: Web Server + cis20: + - CIS 3 + - CIS 5 + - CIS 16 +cve: + - CVE-2022-22954 + confidence: 70 + context: + - Scope:Network + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log + impact: 70 + kill_chain_phases: + - Exploitation + message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred. + mitre_attack_id: + - T1190 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Web.http_method + - Web.url + - Web.url_length + - Web.src + - Web.dest + - Web.http_user_agent + risk_score: 49 + security_domain: network diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml new file mode 100644 index 0000000000..5fd5d369ac --- /dev/null +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -0,0 +1,23 @@ +name: VMware Server Side Injection and Privilege Escalation +id: d6d51cc2-a092-43b7-9f61-1159943afe39 +version: 1 +date: '2022-05-19' +author: Michael Haag, Splunk +description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. +narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. + To further exacerbate this issue, VMware also disclosed a local privilege escalation issue, CVE-2022-22960, which permits the attacker to gain root after exploiting CVE-2022-22954. + Products affected by CVE-2022-22954 include + 1. VMware Workspace ONE Access (Access) 20.10.0.0 – 20.10.0.1, 21.08.0.0 – 21.08.0.1 \ + 1. VMware Identity Manager (vIDM) 3.3.3 – 3.3.6 \' +references: + - https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis + - https://www.cisa.gov/uscert/sites/default/files/publications/CISA_CSA_Threat_Actors_Chaining_VMware_Unpatched_Vulnerabilities_for_Full_System_Control.pdf +tags: + analytic_story: VMware Server Side Injection and Privilege Escalation + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection diff --git a/tests/web/vmware_server_side_template_injection_hunt.test.yml b/tests/web/vmware_server_side_template_injection_hunt.test.yml new file mode 100644 index 0000000000..391bdc5282 --- /dev/null +++ b/tests/web/vmware_server_side_template_injection_hunt.test.yml @@ -0,0 +1,13 @@ +name: VMware Server Side Template Injection Hunt Unit Test +tests: +- name: VMware Server Side Template Injection Hunt + file: web/vmware_server_side_template_injection_hunt.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: vmware_scanning_pan_threat.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log + source: pan:threat + sourcetype: pan:threat + update_timestamp: true diff --git a/tests/web/vmware_workspace_one_freemarker_server_side_template_injection.test.yml b/tests/web/vmware_workspace_one_freemarker_server_side_template_injection.test.yml new file mode 100644 index 0000000000..60df1c4ea5 --- /dev/null +++ b/tests/web/vmware_workspace_one_freemarker_server_side_template_injection.test.yml @@ -0,0 +1,13 @@ +name: VMware Workspace ONE Freemarker Server-side Template Injection Unit Test +tests: +- name: VMware Workspace ONE Freemarker Server-side Template Injection + file: web/vmware_workspace_one_freemarker_server_side_template_injection.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: vmware_scanning_pan_threat.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log + source: pan:threat + sourcetype: pan:threat + update_timestamp: true