VMWare Workspace ONE Access - RCE (CVE-2022-22954)

CVE-2022-22954 is a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager, stemming from server-side template injection. Attackers with network access can leverage this flaw to execute arbitrary code on vulnerable servers.

CrowdSec has been tracking this vulnerability and its exploits since 13th of April 2022.

CrowdSec network observations suggest that most exploitation of CVE-2022-22954 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2022-22954. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Detection patterns indicate that exploitation attempts typically involve requests to URLs containing /catalog-portal/ui/oauth/verify along with specific template injection strings.