Remote Code Execution Vulnerability in VMware Workspace ONE Access and vRealize Automation

CVE-2022-22957

Summary

VMware Workspace ONE Access, Identity Manager, and vRealize Automation are susceptible to remote code execution due to improper deserialization of untrusted data. An attacker with administrative privileges can exploit this vulnerability by sending a carefully crafted JDBC URI, leading to potentially harmful outcomes including unauthorized remote code execution on the affected systems.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2022-22957
Created by Rapid7

References