VMware Workspace ONE - RCE WAF Rule by crowdsecurity | CrowdSec Hub

VMware Workspace ONE - RCE

WAF rulehttp:exploitcve.CVE-2022-22954MITRE T1595MITRE T1190

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/vpatch-CVE-2022-22954

VMWare Workspace ONE Access RCE (CVE-2022-22954)

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Virtual Patching.

View NPMplus →

Installation

sudo cscli appsec-rules install crowdsecurity/vpatch-CVE-2022-22954

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

appsec-rules/crowdsecurity/vpatch-CVE-2022-22954.yaml· 36 linesGitHub

1name: crowdsecurity/vpatch-CVE-2022-22954
2description: "VMWare Workspace ONE Access RCE (CVE-2022-22954)"
3rules:1
4  - and:
5       - zones:2
6           - URI
7         transform:3
8           - lowercase
9         match:4
10           type: contains
11           value: /catalog-portal/ui/oauth/verify
12       - zones:2
13           - ARGS
14         variables:1
15           - deviceUdid
16         transform:3
17           - lowercase
18         match:4
19           type: contains
20           value: ${
21
22labels:5
23   type: exploit
24   service: http
25   confidence: 3
26   spoofable: 0
27   behavior: "http:exploit"
28   label: "VMware Workspace ONE - RCE"
29   references:
30    - https://www.rapid7.com/blog/post/2022/04/29/widespread-exploitation-of-vmware-workspace-one-access-cve-2022-22954/
31    - https://unit42.paloaltonetworks.com/cve-2022-22954-vmware-vulnerabilities/
32    - https://nvd.nist.gov/vuln/detail/cve-2022-22954
33   classification:
34     - cve.CVE-2022-22954
35     - attack.T1595
36     - attack.T1190

VMware Workspace ONE - RCE

Installation

Configuration

Installed on

Know where it runs