CVE-2022-22957

Related Files

VMware Workspace ONE Remote Code Execution

Posted Apr 18, 2023

Authored by mr_me, jheysel-r7 | Site metasploit.com

This Metasploit module combines two vulnerabilities in order achieve remote code execution in the context of the horizon user. The first vulnerability, CVE-2022-22956, is an authentication bypass in OAuth2TokenResourceController ACS which allows a remote, unauthenticated attacker to bypass the authentication mechanism and execute any operation. The second vulnerability, CVE-2022-22957, is a JDBC injection remote code execution vulnerability specifically in the DBConnectionCheckController class's dbCheck method which allows an attacker to deserialize arbitrary Java objects which can allow for remote code execution.

tags | exploit, java, remote, arbitrary, vulnerability, code execution

advisories | CVE-2022-22956, CVE-2022-22957

SHA-256 | 7c29d90e3f3e9d482ff4bcd4e44dc3c7f3847da9e1f2f563dc1812dc6362bcd4

Download | Favorite | View