High
CVE-2022-22956
CVE-2022-22956
Description
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
Add Assessment
Technical Analysis
This vulnerability is an authentication bypass in VMware Workspace ONE and related products. The list of affected products and corresponding versions are:
| Vulnerable Application | Vulnerable version |
|---|---|
| VMware Workspace ONE Access (Access) | 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0 |
| VMware Identity Manager (vIDM) | 3.3.6, 3.3.5, 3.3.4, 3.3.3 |
| VMware vRealize Automation (vRA) | 8.x, 7.6 |
| VMware Cloud Foundation | 4.x |
Reasoning for Exploitability & Attacker Value ratings:
This vulnerability was bundled in VMSA-2022-0011 along with 8 other CVEs. Out of all the CVEs in this advisory CVE-2022-22954 really stole the show as it was an unauthenticated remote code execution vulnerability. Not as many paid much mind to this CVE + CVE-2022-22957 (authenticated RCE) which when combined together with CVE-2022-22960 (LPE) gives attackers yet another exploitation path to unauthenticated remote code execution in the context of the root user.
How it works:
The vulnerability lies in the fact that vulnerable VMware Workspace ONE Access versions shipped with two different default OAuth2 clients. By navigating to https://photon-machine/SAAS/admin/settings/manage/manageOAuthClients/ on a vulnerable instance under Remote App Access users can see two separate Client IDs which are enabled by default to receive User Access Tokens in the scope of “system, admin”:
| CLIENT ID | SCOPE | ACCESS TYPE | STATUS |
|---|---|---|---|
| acs | system,admin | User Access Token | Enabled |
| Service__OAuth2Client | system,admin | User Access Token | Enabled |
The auth by-pass works by abusing com.vmware.horizon.rest.controller.oauth2.OAuth2TokenResourceController which has two exposed endpoints: /generateActivationToken/{id} and /activate . The first will generate an activation code for an existing oauth2 client (which we know two exist by default) and the second will activate the device oauth2 client by exchanging the activation code for a client ID and secret.
Then the attacker can exchange the client_id and client_secret for an OAuth2 token and viola, the attacker has completely by-passed VMware’s authentication mechanism.
References:
CVSS V3 Severity and Metrics
General Information
Vendors
- vmware
Products
- identity manager 3.3.3,
- identity manager 3.3.4,
- identity manager 3.3.5,
- identity manager 3.3.6,
- vrealize automation,
- vrealize automation 7.6,
- workspace one access 20.10.0.0,
- workspace one access 20.10.0.1,
- workspace one access 21.08.0.0,
- workspace one access 21.08.0.1
Metasploit Modules
References
