Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)

Summary: VMware published advisory VMSA-2022-0011 on April 6, 2022 covering eight vulnerabilities including CVE-2022-22954, a server-side template injection remote code execution flaw in Workspace ONE Access and Identity Manager that Unit 42 says is trivial to exploit with a single HTTP request. Unit 42 observed exploitation attempts and scanning as early as April 11, VMware confirmed active exploitation on April 13, and attackers used the flaw to drop Mirai and Enemybot variants, webshells, Stealth Shellbot Perl scripts, and an XMRig coinminer, while CVE-2022-22960 allows privilege escalation to root via overwritable sudo paths.
Bottom line: Cortex Xpanse identified roughly 800 VMware Workspace ONE Access instances connected to the public internet, and the Enemybot samples observed here embed the CVE-2022-22954 exploit so infected machines propagate the attack themselves.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2017-17215 CVE-2022-22954 CVE-2022-22955 CVE-2022-22956 CVE-2022-22957 CVE-2022-22958 CVE-2022-22959 CVE-2022-22960 CVE-2022-22961 CVE-2022-22972 CVE-2022-22973
Related: CVE-2022-22960: VMware Multiple Products Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Apr 15, 2022
CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability Known Exploited Vulnerabilities · Apr 14, 2022
IoT Malware Evolves to Harvest Bots by Exploiting a Zero-day Home Router Vulnerability Cyber Risks ·