CVE-2022-22954

CVE-2022-22954: VMware Workspace ONE Access Server-Side Template Injection (SSTI)

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2022-22954 is a critical server-side template injection (SSTI) vulnerability in VMware Workspace ONE Access and Identity Manager. An unauthenticated attacker with network access can inject malicious template expressions into user-facing input fields, leading to arbitrary remote code execution on the underlying host. With a CVSS v3.1 score of 9.8 and active exploitation confirmed by CISA and the EU Vulnerability Database, this flaw demands immediate remediation.

Background

VMware Workspace ONE Access is an enterprise identity and access management platform that provides single sign-on (SSO), multi-factor authentication, and conditional access across SaaS, web, and native applications. Identity Manager is the on-premises deployment variant of the same technology stack. Both products rely on server-side templating engines to render dynamic content in web interfaces. Improper neutralization of user input within these templates creates an injection surface that can be weaponized for full system compromise.

Root Cause — CWE-94: Code Injection

The vulnerability stems from inadequate input validation and sanitization before user-supplied data is passed to a server-side template engine. Specifically, the application evaluates attacker-controlled input as template expressions rather than literal data. This is a classic instance of CWE-94: Code Injection. The templating engine's expression parser does not enforce a strict separation between template logic and user data, allowing an attacker to break out of the data context and execute arbitrary code within the template runtime. The resulting code execution inherits the privileges of the application server process, typically running with elevated or system-level permissions.

Impact

The CVSS v3.1 metrics paint a severe picture:

• Attack Vector (AV): Network — exploitable remotely without local access.
• Attack Complexity (AC): Low — no special conditions or race conditions required.
• Privileges Required (PR): None — fully unauthenticated.
• User Interaction (UI): None — no victim action needed.
• Scope (S): Unchanged — impact stays within the vulnerable component.
• Confidentiality (C), Integrity (I), Availability (A): All High.

An attacker can read sensitive configuration files, pivot laterally within the network, deploy ransomware, or establish persistent backdoors. The CVSS v2 score of 10.0 and EPSS of 0.99997 reflect both the ease of exploitation and the near-certainty of in-the-wild abuse.

Exploitation Walkthrough (Defensive Perspective)

Ethics caveat: The following description is provided for defensive detection, network monitoring, and patch-verification purposes only. Do not use this information to attack systems without explicit authorization.

An attacker typically targets the authentication or self-service registration endpoints of Workspace ONE Access. The malicious payload is crafted as a server-side template expression (the exact syntax depends on the underlying engine, e.g., Freemarker, Velocity, or a custom VMware implementation). When the server renders the page, the template engine evaluates the expression, resulting in command execution. Common observable indicators include:

1. Unexpected outbound connections from the Workspace ONE Access server to attacker-controlled infrastructure.
2. Child process spawning under the Tomcat or service account (e.g., cmd.exe, powershell.exe, or /bin/sh).
3. File-system modifications in the web application directories or temporary folders.
4. Anomalous HTTP POST requests to login or profile endpoints containing template-like delimiters (${...}, {{...}}, <#...>).

Defenders should monitor web access logs for these patterns and correlate with process-creation telemetry on the host.

Affected and Patched Versions

The following products and versions are confirmed vulnerable based on CPE data from NVD:

• VMware Identity Manager: 3.3.3, 3.3.4, 3.3.5, 3.3.6
• VMware Workspace ONE Access: 20.10.0.0, 20.10.0.1, 21.08.0.0, 21.08.0.1
• VMware vRealize Automation: 7.6
• VMware Cloud Foundation: all versions (advisory recommends patching)
• VMware vRealize Suite Lifecycle Manager: all versions (advisory recommends patching)

VMware released patches in VMSA-2022-0011. Administrators should consult the official advisory for the latest patch matrix and build numbers, as additional affected versions may have been identified since initial publication.

Remediation

1. Patch immediately. Apply the updates listed in VMware Security Advisory VMSA-2022-0011. Prioritize internet-facing instances and any systems listed in the CISA KEV catalog.
2. Compensating controls: If patching is not immediately feasible, restrict network access to the administrative and user portals using firewall rules, VPN enforcement, or WAF policies. Note that this does not eliminate the vulnerability—only reduces exposure.
3. Disable unnecessary features: Turn off self-service registration or external identity-provider integrations if they are not required, as these may expose the vulnerable template-rendering paths.
4. Review integrations: Ensure that downstream systems relying on Workspace ONE Access for authentication are not implicitly trusting tokens issued by a compromised instance.

Detection

• Network: Monitor for HTTP requests containing template-injection signatures (${, {{, <#) in POST bodies to Workspace ONE Access endpoints.
• Endpoint: Alert on child process creation by the Workspace ONE Access service account (e.g., Java/Tomcat spawning shells or scripting interpreters).
• Identity: Look for anomalous SSO token issuance, unexpected application assignments, or privilege-escalation events within the Workspace ONE directory.
• Threat-intelligence: Cross-reference external IP communications against known indicators of compromise (IOCs) associated with post-exploitation frameworks observed in KEV-related incidents.

Assessment

CVE-2022-22954 is a textbook example of why server-side template injection remains one of the most dangerous web-application vulnerability classes. The combination of unauthenticated access, low attack complexity, and high-impact outcome (full RCE) makes it an ideal target for mass exploitation. The EPSS of 0.99997 and inclusion in both the CISA KEV and EU vulnerability databases confirm that this is not a theoretical risk—it has been actively exploited in ransomware campaigns since April 2022.

Key lessons:

1. Never trust user input in template contexts. All data bound to server-side templates must be treated as untrusted and escaped or sandboxed appropriately.
2. Kinematic patching is essential. A three-day gap between disclosure and KEV listing (2022-04-11 to 2022-04-14) demonstrates how quickly attackers weaponize high-impact, unauthenticated RCE flaws. Organizations must have an emergency-patch process for critical infrastructure with internet exposure.

References

• https://www.vmware.com/security/advisories/VMSA-2022-0011.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22954
• http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html