{"uuid": "9f1c5ff2-83be-4d53-abb5-5d6326214cdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-22954", "type": "exploited", "source": "https://t.me/hacking_Attack/53991", "content": "Black Hat Ethical Hacking\nApril VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell\n\nApril VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4ShellPost Views: 11 \nPremium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nRecently reported VMware bugs are being used by hackers who are focused on using them to deliver Mirai denial-of-service malware and exploit the Log4Shell\u00a0vulnerability. Security researchers at Barracuda\u00a0discovered that attempts were made to exploit the recent vulnerabilities CVE-2022-22954\u00a0and CVE-2022-22960, both reported last month.\n\n\u201cBarracuda researchers analyzed the attacks and payloads detected by Barracuda systems between April to May and found a steady stream of attempts to exploit two recently uncovered VMware vulnerabilities: CVE-2022-22954 and CVE-2022-22960\u201d reported by Barracuda.\n\nVMware published an advisory\u00a0on April 6, 2022, which detailed multiple security vulnerabilities. The most severe of these is CVE-2022-22954 with a CVSS score of 9.8, the bug allows an attacker with network access to perform remote code execution via server-side template injection on VMware Workspace ONE Access and Identity Manager Solutions.\n\nThe other bug involved CVE-2022-22960 (CVSS score 7.8), is a local privilege escalation vulnerability in VMware Workspace ONE Access, Identity Manager, and vRealize Automation. According to the advisory by VMware, the bug arises due to improper permission in support scripts allowing an attacker with local access to gain root privileges.\n\nThe VMware Workspace One is an intelligent-drive workspace platform that helps to manage any app on any device in a secure and simpler manner. The Identity manager handles the authentication to the platform and vRealize Automation is a DevOps-based infrastructure management platform for config of IT resources and automating the delivery of container-based applications.\nSee Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Exploitation Occurred After PoC ReleaseThe Barracuda researchers noted that the previous flaws are chained together for a potential full exploitation vector.\n\nAfter the bug was disclosed by VMware in April, a proof-of-concept (PoC)\u00a0was released on Github and shared via Twitter.\n\n\u201cBarracuda researchers started seeing probes and exploit attempts for this vulnerability soon after the release of the advisory and the initial release of the proof of concept on GitHub,\u201d reported Barracuda.\n\nAfter the release of PoC, the spike in attempts is noticed by the researcher, they classified it as a probe rather than actual attempts to exploit.\n\n\u201cThe attacks have been consistent over time, barring a few spikes, and the vast majority of them are what would be classified as probes rather than actual exploit attempts,\u201d they added.\nSee Also: Attackers Use Event Logs to Hide Fileless Malware The researchers at Barracuda also revealed that most of the exploit attempts are primarily from botnet operators, the IPs discovered still seem to host variants of the Mirai distributed-denial-of-service (DDoS) botnet malware, along with some Log4Shell exploits and low levels of EnemyBot (a type of DDoS botnet) attempts.\n\nThe majority of the attacks (76 percent) originated from the U.S. geographically, with most of them coming from data centers and cloud providers. The researcher added that there is a spike in IP addresses from the UK and Russia and about (6 percent) of the attacks emanate from these locations.\n\nThe researchers noted, \u201cthere are also consistent background attempts from known bad IPs in Russia.\u201d\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:37.215928Z"}