Threat Signal Report

Newly Patched VMware Vulnerability (CVE-2022-22954) Being Exploited in the Wild

Description

FortiGuard Labs is aware that VMware has confirmed a recently patched critical vulnerability in VMware Workspace ONE Access and Identity Manager (CVE-2022-22954) has been exploited in the wild. Also, a Proof-of-Concept (PoC) code has already been made available to the public. An attacker with network access can trigger a server-side template injection that may result in remote code execution.

Why is this Significant?
This is significant because of the critical remote code execution vulnerability affecting Workspace ONE Access and VMware Identity Manager (vIDM) that are widely used. Since VMware has acknowledged in-the-wild exploitation of CVE-2022-22954 and a POC is available to the public, attacks that leverage the vulnerability will likely increase.

What is CVE-2022-22954?
CVE-2022-22954 is a vulnerability in Workspace ONE Access and VMware Identity Manager (vIDM), which an attacker with network access can trigger a server-side template injection that may result in remote code execution. The vulnerability has the CVSSv3 base score of 9.8 and is rated critical.

Is the Vulnerability Exploited in the Wild?
VMware has confirmed that exploitation of CVE-2022-22954 has occurred in the wild.

Has the Vendor Released Security Advisories for CVE-2022-22954?

Yes, VMware released a security advisory for the vulnerability on April 6th, 2022. See the Appendix for a link to "VMSA-2022-0011".

The advisory was updated further on April 13th, 2022 for the confirmation of the in-the-wild exploitation.

Has the Vendor Released a Patch for CVE-2022-22954?

Yes, VMware released a patch on April 6th, 2022 as part of its security advisory. See the Appendix for a link to "VMSA-2022-0011".

What is the Status of Coverage?
FortiGuard Labs has released the following IPS signature for CVE-2022-22954 in version 20.297:

VMware.Workspace.ONE.Access.Catalog.Remote.Code.Execution (default action is set to pass)

What Mitigation Steps are Available?
VMware has released a KB article that includes the workaround. See the Appendix for a link to "HW-154129 - Workaround instructions to address CVE-2022-22954, CVE-2022-22955, CVE-2022-22956, CVE-2022-22957, CVE-2022-22958, CVE-2022-22959, CVE-2022-22960 in Workspace ONE Access Appliance (VMware Identity Manager) (88098)".