CVE-2021-22054: Omnissa Workspace ONE Server-Side Request Forgery

Omnissa Workspace ONE UEM, formerly VMware Workspace ONE UEM, contains a server-side request forgery vulnerability tracked as CVE-2021-22054. A malicious actor with network access to the UEM instance can send requests without authentication and obtain sensitive information.

The issue belongs to the class of server-side request forgery weaknesses and affects organizations that rely on this product for endpoint and device management.

How it works

CWE-918 describes server-side request forgery, in which an application accepts attacker-controlled input and uses it to construct outbound requests from the server itself. In this case the flaw permits an unauthenticated actor who can reach the UEM service to cause the server to issue requests that would otherwise be restricted, potentially exposing internal resources or data reachable from the server.

• Attackers do not need valid credentials; network reachability to the UEM instance is sufficient.
• The requests originate from the server, so they may bypass network controls that protect the backend from external clients.
• Exact request formats and target scopes must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

Workspace ONE UEM is typically deployed in enterprise environments to manage mobile devices, desktops, and applications. Inventory begins with identifying all installations or cloud tenants of Omnissa Workspace ONE UEM (or its former VMware branding) that are reachable from untrusted networks.

• Review asset inventories, configuration management databases, and network diagrams for UEM servers or cloud connectors.
• Check both on-premises and hosted deployments, because the product supports both models.
• Examine authentication and network access controls around the UEM administrative and API endpoints.
• Log or telemetry indicators of exploitation are not specified in the supplied facts; confirm expected monitoring guidance in the vendor advisory.

How to remediate

Apply mitigations per the vendor instructions. The primary action is to install the update or configuration change released by Omnissa (formerly VMware) that addresses CVE-2021-22054.

• Follow applicable CISA BOD 22-01 guidance for cloud services that use the product.
• After patching, verify that the affected request-handling paths no longer accept unauthenticated input that can be used to generate outbound requests.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure by limiting network access to the UEM instance to only trusted management networks. Consider placing the service behind an additional access-control layer or web-application firewall that enforces authentication on all endpoints that accept external input.

• Segment the UEM servers so they cannot reach sensitive internal systems that should not be queried by the application.
• Disable or restrict any features that allow the server to issue arbitrary outbound requests if the configuration option exists.
• Monitor logs for unusual outbound connection attempts originating from the UEM service.
• If mitigations cannot be implemented, discontinue use of the affected deployment.

If your data may have been exposed

Server-side request forgery vulnerabilities that permit unauthenticated access have been used to obtain sensitive information in other products. Organizations should assume that successful exploitation could result in data exposure and should review access logs for the UEM instance. Readers can run a free exposure scan of their email addresses against known breach data to check for prior incidents involving their domains.