{"uuid": "f97851a8-9d11-4c84-ba63-b31c99687876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22056", "type": "seen", "source": "https://t.me/hacking_Attack/39246", "content": "Black Hat Ethical Hacking\nSSRF vulnerability in VMWare authentication software could allow access to user data\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png SSRF vulnerability in VMWare authentication software could allow access to user dataPost Views: 128 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nA\u00a0server-side request forgery\u00a0(SSRF) vulnerability in versions of VMWare authentication software could allow an attacker to obtain administrative JSON Web Tokens (JWT), researchers warn.\nThe SSRF bug was found in VMware Workspace ONE Access (previously known as Identity Manager), which provides multi-factor authentication, conditional access and single sign-on to SaaS, web, and native mobile apps.\n\nThe vulnerability (tracked as CVE-2021-22056), which was assigned a \u2018moderate\u2019 severity score of 5.5, could enable a malicious actor with network access to make HTTP requests to arbitrary origins and read the full response.\n\nA blog post reads: \u201cDue to the lack of a slash character, it is possible for an attacker to make HTTP requests to arbitrary origins and read the full response.\n\n\u201cFurthermore, an authorization header gets leaked and hence it is possible for an attacker to weaponize this vulnerability to steal the authorization header of an admin upon viewing an image or making a single click.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course Access all areasResearchers Shubham Shah and Keiran Sampson, who discovered the bug, said that this could lead to the leaking of JWTs \u2013 potentially allowing a malicious actor full access to a vulnerable system.\n\nJWTs are URL safe strings that are used to identify a user. They contain JSON-encoded data, making them convenient for embedding information.\n\nThey are typically used as session identifiers for web applications, mobile applications, and API services. They also contain user data directly, unlike traditional session identifiers which simply point to user data on the server-side.\n\nIf a user\u2019s JWTs are stolen or compromised, an attacker can potentially gain full access to the user\u2019s account.\n\nMore information about the use of JWTs can be found here.\n\nResearchers pointed out that the leaking of the JWT \u201cincreases the severity of the issue as this vulnerability can be used in spear phishing attacks against organizations\u00a0that use VMWare Workspace One Access\u201d.\n\nShah and Sampson, who discovered the bug, also found a second issue, an authentication bypass vulnerability in VMware Workspace ONE Access (CVE-2021-22057).\n\nThe vulnerability, impacting VMware Verify two factor authentication, was also rated as a moderate severity bug with a score of 6.6.\n\nThe security issue means a malicious actor who has successfully provided the first-factor in an authentication process (such as a password), may be able to obtain second-factor authentication provided by VMware Verify.\n\nA security advisory\u00a0contains further details about which versions of the software are at risk.\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Microsoft: New critical Windows HTTP vulnerability is wormable Patch issuedVMWare has patched both security issues in its latest version of the enterprise software.\n\nIn their blog post, Shah and Sampson thanked the ven[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T13:00:05.320333Z"}