Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2022-22954 | Server-Side Template Injection RCE in VMware Workspace ONE Access and Identity Manager | 9.8 | 100% | KEVRansomwarePoC | KEV |
CVE-2022-22956+1 related CVE | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework | 9.8 | 50% | ||
CVE-2022-22957+3 related CVEs | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958) | 7.2 group max | 24% | ||
| CVE-2022-22960 | Local Privilege Escalation in VMware Workspace ONE Access, Identity Manager and vRA | 7.8 | 36% | KEVPoC ×3 | KEV |
CVE-2022-22972+1 related CVE | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users | 9.8 group max | 56% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | tmpfiles.org | hxxp://20[.]205.61.88/payllll.sh 45[.]149.77.39:80 hxxps://tmpfiles[.]org/dl/262822/a.txt hxxps://tmpfiles[.]org/dl/266116/vmware_l |
| domain | x.pipedream.net | 9/13.jsp Callback/Scanning activity hxxps://enlib2w9g8mze[.]x.pipedream.net Direct Download exploits where payloads were no longer live |
| ipv4 | 101.42.89.186 | the time of analysis: hxxp://106[.]246.224.219/one /dev/tcp/101[.]42.89.186/1234 hxxp://192[.]3.1.223/favicon.ico hxxp://20[.]205.61. |
| ipv4 | 103.43.18.15 | e/horizon/workspace/webapps/ROOT/error/report1.jsp%20hxxp://103[.]43.18.15:8089/13.jsp Callback/Scanning activity hxxps://enlib2w9g8 |
| ipv4 | 103.64.13.51 | tVNC Coinminer activity hxxp://185[.]157.160.214/xms hxxp://103[.]64.13.51:8452/cnm hxxp://113[.]185.0.244/wls-wsat/root Webshell do |
| ipv4 | 106.246.224.219 | ayloads were no longer live at the time of analysis: hxxp://106[.]246.224.219/one /dev/tcp/101[.]42.89.186/1234 hxxp://192[.]3.1.223/fa |
| ipv4 | 107.148.12.162 | 8.13.247/error.txt hxxp://107[.]148.13.247:7777/file hxxp://107[.]148.12.162:12345/log hxxp://45[.]144.179.204:9999/log /dev/tcp/193[. |
| ipv4 | 107.148.13.247 | .]org/dl/265326/cmd.jsp hxxp://107[.]191.43.86/start hxxp://107[.]148.13.247/4file hxxp://107[.]148.13.247/error.txt hxxp://107[.]148. |
| ipv4 | 107.191.43.86 | 51/shell.py hxxps://tmpfiles[.]org/dl/265326/cmd.jsp hxxp://107[.]191.43.86/start hxxp://107[.]148.13.247/4file hxxp://107[.]148.13.2 |
| ipv4 | 113.185.0.244 | 185[.]157.160.214/xms hxxp://103[.]64.13.51:8452/cnm hxxp://113[.]185.0.244/wls-wsat/root Webshell downloads (full injected command) |
| ipv4 | 129.226.227.246 | cp/193[.]56.28.202/443 /dev/tcp/193[.]56.28.202/444 hxxps://129[.]226.227.246/help.txt hxxps://20[.]232.97.189/up/4102909932.sh hxxps:/ |
| ipv4 | 135.148.91.146 | KK/NW_BBB.x86 hxxp://198[.]46.189.105:80/Ugliest.x86 hxxp://135[.]148.91.146:1980/bins.sh hxxp://80[.]94.92.38/folder/enemybotarm64/ h |
| ipv4 | 138.68.61.82 | bea27b13.sh hxxps://20[.]232.97.189/up/388e6567d5.sh hxxp://138[.]68.61.82:444 Sample hashes 801b23bffa65facee1da69bc6f72f8e1e4e1aee |
| ipv4 | 185.157.160.214 | t.redis 193[.]56.28.202/.d/botVNC Coinminer activity hxxp://185[.]157.160.214/xms hxxp://103[.]64.13.51:8452/cnm hxxp://113[.]185.0.244 |
| ipv4 | 192.3.1.223 | /106[.]246.224.219/one /dev/tcp/101[.]42.89.186/1234 hxxp://192[.]3.1.223/favicon.ico hxxp://20[.]205.61.88/payllll.sh 45[.]149.77. |
| ipv4 | 193.56.28.202 | x86/ hxxp://80[.]94.92.38/folder/enemybotx64/ Perl Shellbot 193[.]56.28.202/.d/bot.v 193[.]56.28.202/.d/bot.redis 193[.]56.28.202/.d/ |
| ipv4 | 198.46.189.105 | ts or variants hxxp://51[.]81.133.91/FKKK/NW_BBB.x86 hxxp://198[.]46.189.105:80/Ugliest.x86 hxxp://135[.]148.91.146:1980/bins.sh hxxp: |
| ipv4 | 20.205.61.88 | 01[.]42.89.186/1234 hxxp://192[.]3.1.223/favicon.ico hxxp://20[.]205.61.88/payllll.sh 45[.]149.77.39:80 hxxps://tmpfiles[.]org/dl/26 |
| ipv4 | 20.232.97.189 | [.]56.28.202/444 hxxps://129[.]226.227.246/help.txt hxxps://20[.]232.97.189/up/4102909932.sh hxxps://20[.]232.97.189/up/d1bea27b13.sh |
| ipv4 | 45.144.179.204 | 8.13.247:7777/file hxxp://107[.]148.12.162:12345/log hxxp://45[.]144.179.204:9999/log /dev/tcp/193[.]56.28.202/443 /dev/tcp/193[.]56.2 |
| ipv4 | 45.149.77.39 | /192[.]3.1.223/favicon.ico hxxp://20[.]205.61.88/payllll.sh 45[.]149.77.39:80 hxxps://tmpfiles[.]org/dl/262822/a.txt hxxps://tmpfile |
| ipv4 | 51.81.133.91 | Compromise Mirai/Gafgyt dropper scripts or variants hxxp://51[.]81.133.91/FKKK/NW_BBB.x86 hxxp://198[.]46.189.105:80/Ugliest.x86 hx |
| ipv4 | 5.39.217.212 | 2e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba C2 server : 5[.]39.217.212:80 Channel : #vcenter getsome bot.redis 48628ca95608a015f |
| ipv4 | 64.32.6.143 | 47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b C2 server : 64[.]32.6.143:80 Channel : #redis getsome botVNC c399b56e1baf063ca2c8aa |
| ipv4 | 80.94.92.38 | :80/Ugliest.x86 hxxp://135[.]148.91.146:1980/bins.sh hxxp://80[.]94.92.38/folder/enemybotarm64/ hxxp://80[.]94.92.38/folder/enemybo |
| sha256 | 099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61 | 15126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b 099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61 Updated May 23, 2022, at 1 p.m. PT. |
| sha256 | 0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba | b6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03 bot.v 0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba C2 server : 5[.]39.217.212:80 Channel : #vcenter getsome bo |
| sha256 | 48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b | er : 5[.]39.217.212:80 Channel : #vcenter getsome bot.redis 48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b C2 server : 64[.]32.6.143:80 Channel : #redis getsome botVN |
| sha256 | 6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b | 3bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637 6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b 940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e |
| sha256 | 7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b | d1956bd5 C2 server : 5[.]39.217.212:80 Channel : #D getsome 7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b 099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe |
| sha256 | 801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637 | 89/up/388e6567d5.sh hxxp://138[.]68.61.82:444 Sample hashes 801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637 6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5a |
| sha256 | 85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03 | d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05 85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03 bot.v 0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c |
| sha256 | 940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8 | c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b 940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8 fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f3 |
| sha256 | c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5 | 2 server : 64[.]32.6.143:80 Channel : #redis getsome botVNC c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5 C2 server : 5[.]39.217.212:80 Channel : #D getsome 7e296151 |
| sha256 | fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05 | 74cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8 fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05 85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b054590 |
| url | http://103.64.13.51:8452/cnm | 2/.d/botVNC Coinminer activity hxxp://185[.]157.160.214/xms hxxp://103[.]64.13.51:8452/cnm hxxp://113[.]185.0.244/wls-wsat/root Webshell downloads ( |
| url | http://106.246.224.219/one | where payloads were no longer live at the time of analysis: hxxp://106[.]246.224.219/one /dev/tcp/101[.]42.89.186/1234 hxxp://192[.]3.1.223/favico |
| url | http://107.148.12.162:12345/log | 07[.]148.13.247/error.txt hxxp://107[.]148.13.247:7777/file hxxp://107[.]148.12.162:12345/log hxxp://45[.]144.179.204:9999/log /dev/tcp/193[.]56.28.202 |
| url | http://107.148.13.247/4file | pfiles[.]org/dl/265326/cmd.jsp hxxp://107[.]191.43.86/start hxxp://107[.]148.13.247/4file hxxp://107[.]148.13.247/error.txt hxxp://107[.]148.13.247 |
| url | http://107.148.13.247:7777/file | ://107[.]148.13.247/4file hxxp://107[.]148.13.247/error.txt hxxp://107[.]148.13.247:7777/file hxxp://107[.]148.12.162:12345/log hxxp://45[.]144.179.204 |
| url | http://107.148.13.247/error.txt | hxxp://107[.]191.43.86/start hxxp://107[.]148.13.247/4file hxxp://107[.]148.13.247/error.txt hxxp://107[.]148.13.247:7777/file hxxp://107[.]148.12.162 |
| url | http://107.191.43.86/start | dl/265351/shell.py hxxps://tmpfiles[.]org/dl/265326/cmd.jsp hxxp://107[.]191.43.86/start hxxp://107[.]148.13.247/4file hxxp://107[.]148.13.247/err |
| url | http://113.185.0.244/wls-wsat/root | hxxp://185[.]157.160.214/xms hxxp://103[.]64.13.51:8452/cnm hxxp://113[.]185.0.244/wls-wsat/root Webshell downloads (full injected command) wget%20-O%20/o |
| url | http://135.148.91.146:1980/bins.sh | 3.91/FKKK/NW_BBB.x86 hxxp://198[.]46.189.105:80/Ugliest.x86 hxxp://135[.]148.91.146:1980/bins.sh hxxp://80[.]94.92.38/folder/enemybotarm64/ hxxp://80[.]94 |
| url | http://138.68.61.82:444 | 9/up/d1bea27b13.sh hxxps://20[.]232.97.189/up/388e6567d5.sh hxxp://138[.]68.61.82:444 Sample hashes 801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63 |
| url | http://185.157.160.214/xms | 2/.d/bot.redis 193[.]56.28.202/.d/botVNC Coinminer activity hxxp://185[.]157.160.214/xms hxxp://103[.]64.13.51:8452/cnm hxxp://113[.]185.0.244/wls |
| url | http://192.3.1.223/favicon.ico | hxxp://106[.]246.224.219/one /dev/tcp/101[.]42.89.186/1234 hxxp://192[.]3.1.223/favicon.ico hxxp://20[.]205.61.88/payllll.sh 45[.]149.77.39:80 hxxps: |
| url | http://198.46.189.105:80/Ugliest.x86 | r scripts or variants hxxp://51[.]81.133.91/FKKK/NW_BBB.x86 hxxp://198[.]46.189.105:80/Ugliest.x86 hxxp://135[.]148.91.146:1980/bins.sh hxxp://80[.]94.92.38 |
| url | http://20.205.61.88/payllll.sh | v/tcp/101[.]42.89.186/1234 hxxp://192[.]3.1.223/favicon.ico hxxp://20[.]205.61.88/payllll.sh 45[.]149.77.39:80 hxxps://tmpfiles[.]org/dl/262822/a.txt |
| url | http://45.144.179.204:9999/log | 07[.]148.13.247:7777/file hxxp://107[.]148.12.162:12345/log hxxp://45[.]144.179.204:9999/log /dev/tcp/193[.]56.28.202/443 /dev/tcp/193[.]56.28.202/444 |
| url | http://51.81.133.91/FKKK/NW_BBB.x86 | tors of Compromise Mirai/Gafgyt dropper scripts or variants hxxp://51[.]81.133.91/FKKK/NW_BBB.x86 hxxp://198[.]46.189.105:80/Ugliest.x86 hxxp://135[.]148.9 |
| url | http://80.94.92.38/folder/enemybotarm64/ | 189.105:80/Ugliest.x86 hxxp://135[.]148.91.146:1980/bins.sh hxxp://80[.]94.92.38/folder/enemybotarm64/ hxxp://80[.]94.92.38/folder/enemybotx86/ hxxp://80[.]94.9 |
| url | http://80.94.92.38/folder/enemybotx64/ | der/enemybotarm64/ hxxp://80[.]94.92.38/folder/enemybotx86/ hxxp://80[.]94.92.38/folder/enemybotx64/ Perl Shellbot 193[.]56.28.202/.d/bot.v 193[.]56.28.202/.d |
| url | http://80.94.92.38/folder/enemybotx86/ | 146:1980/bins.sh hxxp://80[.]94.92.38/folder/enemybotarm64/ hxxp://80[.]94.92.38/folder/enemybotx86/ hxxp://80[.]94.92.38/folder/enemybotx64/ Perl Shellbot 19 |
| url | https://129.226.227.246/help.txt | g /dev/tcp/193[.]56.28.202/443 /dev/tcp/193[.]56.28.202/444 hxxps://129[.]226.227.246/help.txt hxxps://20[.]232.97.189/up/4102909932.sh hxxps://20[.]232 |
| url | https://20.232.97.189/up/388e6567d5.sh | 9/up/4102909932.sh hxxps://20[.]232.97.189/up/d1bea27b13.sh hxxps://20[.]232.97.189/up/388e6567d5.sh hxxp://138[.]68.61.82:444 Sample hashes 801b23bffa65facee |
| url | https://20.232.97.189/up/4102909932.sh | /tcp/193[.]56.28.202/444 hxxps://129[.]226.227.246/help.txt hxxps://20[.]232.97.189/up/4102909932.sh hxxps://20[.]232.97.189/up/d1bea27b13.sh hxxps://20[.]232 |
| url | https://20.232.97.189/up/d1bea27b13.sh | 6.227.246/help.txt hxxps://20[.]232.97.189/up/4102909932.sh hxxps://20[.]232.97.189/up/d1bea27b13.sh hxxps://20[.]232.97.189/up/388e6567d5.sh hxxp://138[.]68. |
| url | https://enlib2w9g8mze.x.pipedream.net | xxp://103[.]43.18.15:8089/13.jsp Callback/Scanning activity hxxps://enlib2w9g8mze[.]x.pipedream.net Direct Download exploits where payloads were no longer li |
| url | https://tmpfiles.org/dl/262822/a.txt | icon.ico hxxp://20[.]205.61.88/payllll.sh 45[.]149.77.39:80 hxxps://tmpfiles[.]org/dl/262822/a.txt hxxps://tmpfiles[.]org/dl/266116/vmware_log.jsp hxxps://t |
| url | https://tmpfiles.org/dl/262853/vmware_log.jsp | 62822/a.txt hxxps://tmpfiles[.]org/dl/266116/vmware_log.jsp hxxps://tmpfiles[.]org/dl/262853/vmware_log.jsp hxxps://tmpfiles[.]org/dl/265385/xmrigdaemon hxxps://tmpf |
| url | https://tmpfiles.org/dl/265326/cmd.jsp | 65385/xmrigdaemon hxxps://tmpfiles[.]org/dl/265351/shell.py hxxps://tmpfiles[.]org/dl/265326/cmd.jsp hxxp://107[.]191.43.86/start hxxp://107[.]148.13.247/4fil |
| url | https://tmpfiles.org/dl/265351/shell.py | vmware_log.jsp hxxps://tmpfiles[.]org/dl/265385/xmrigdaemon hxxps://tmpfiles[.]org/dl/265351/shell.py hxxps://tmpfiles[.]org/dl/265326/cmd.jsp hxxp://107[.]191 |
| url | https://tmpfiles.org/dl/265385/xmrigdaemon | are_log.jsp hxxps://tmpfiles[.]org/dl/262853/vmware_log.jsp hxxps://tmpfiles[.]org/dl/265385/xmrigdaemon hxxps://tmpfiles[.]org/dl/265351/shell.py hxxps://tmpfile |
| url | https://tmpfiles.org/dl/266116/vmware_log.jsp | sh 45[.]149.77.39:80 hxxps://tmpfiles[.]org/dl/262822/a.txt hxxps://tmpfiles[.]org/dl/266116/vmware_log.jsp hxxps://tmpfiles[.]org/dl/262853/vmware_log.jsp hxxps://t |
From the original article
5 min read at unit42.paloaltonetworks.com
On April 6, 2022, VMware published a security advisory mentioning eight vulnerabilities, including CVE-2022-22954 and CVE-2022-22960 impacting their products VMware Workspace ONE Access, Identity Manager and vRealize Automation. On April 13, they updated their advisory with information that CVE-2022-22954 is being exploited in the wild.
By Ruchna Nigam · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.