mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
pyth0n1c
70 lines
2.6 KiB
YAML
70 lines
2.6 KiB
YAML
name: VMware Server Side Template Injection Hunt
|
|
id: 5796b570-ad12-44df-b1b5-b7e6ae3aabb0
|
|
version: 1
|
|
date: '2022-05-19'
|
|
author: Michael Haag, Splunk
|
|
type: Hunting
|
|
datamodel:
|
|
- Web
|
|
description: The following hunting analytic identifies the server side template injection related to CVE-2022-22954, however is a variation found within the same endpoint of the URL scheme.
|
|
search: '| tstats count from datamodel=Web where Web.http_method IN ("GET")
|
|
Web.url="*deviceudid=*" AND Web.url IN ("*java.lang.ProcessBuilder*","*freemarker.template.utility.ObjectConstructor*")
|
|
by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype
|
|
| `drop_dm_object_name("Web")`
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `vmware_server_side_template_injection_hunt_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
web or proxy logs, or ensure it is being filled by a proxy like device, into the
|
|
Web Datamodel. For additional filtering, allow list private IP space or restrict
|
|
by known good.
|
|
known_false_positives: False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
|
|
references:
|
|
- https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
|
|
- https://github.com/wvu/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_workspace_one_access_cve_2022_22954.rb
|
|
- https://github.com/sherlocksecurity/VMware-CVE-2022-22954
|
|
- https://www.vmware.com/security/advisories/VMSA-2022-0011.html
|
|
- https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis
|
|
- https://twitter.com/wvuuuuuuuuuuuuu/status/1519476924757778433
|
|
tags:
|
|
analytic_story:
|
|
- VMware Server Side Injection and Privilege Escalation
|
|
asset_type: Web Server
|
|
cis20:
|
|
- CIS 3
|
|
- CIS 5
|
|
- CIS 16
|
|
cve:
|
|
- CVE-2022-22954
|
|
confidence: 50
|
|
context:
|
|
- Scope:Network
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_scanning_pan_threat.log
|
|
impact: 70
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
message: An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred.
|
|
mitre_attack_id:
|
|
- T1190
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- Web.http_method
|
|
- Web.url
|
|
- Web.url_length
|
|
- Web.src
|
|
- Web.dest
|
|
- Web.http_user_agent
|
|
risk_score: 35
|
|
security_domain: network
|