CVE-2022-31659: VMware Identity Manager RCE Vulnerability

CVE-2022-31659 Overview

CVE-2022-31659 is a remote code execution vulnerability affecting VMware Workspace ONE Access and VMware Identity Manager. An authenticated attacker with administrator privileges and network access to the management interface can trigger arbitrary code execution on the underlying host. The flaw is tracked under CWE-89 (SQL Injection), indicating that improperly sanitized input reaches a database query and enables code execution against the appliance.

VMware addressed the issue in security advisory VMSA-2022-0021. The vulnerability impacts Linux-based appliances and Windows-based connectors used in enterprise single sign-on (SSO) deployments.

Critical Impact
An administrator-level attacker can pivot from a compromised management session to full remote code execution on identity infrastructure that brokers authentication for downstream applications.

Affected Products

VMware Identity Manager versions 3.3.4, 3.3.5, and 3.3.6
VMware Workspace ONE Access versions 21.08.0.0 and 21.08.0.1
VMware Identity Manager Connector and Access Connector (versions 19.03.0.1, 22.05, 22.08.0.0, 22.08.0.1) on Linux and Windows

Discovery Timeline

2022-08-05 - CVE-2022-31659 published to the National Vulnerability Database
2022-08-05 - VMware publishes advisory VMSA-2022-0021
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-31659

Vulnerability Analysis

The vulnerability resides in administrative functionality of VMware Workspace ONE Access and Identity Manager. User-supplied input handled by an administrative endpoint is incorporated into a backend database query without proper parameterization. This SQL injection condition, classified as [CWE-89], can be chained to achieve remote code execution on the appliance.

Workspace ONE Access brokers authentication for SaaS and on-premises applications. Code execution on the appliance gives an attacker control over identity tokens, signing keys, and connector trust relationships. The attack vector is the network, but exploitation requires high privileges — specifically a valid administrator session against the management interface.

With an EPSS score in the 82nd percentile, the issue draws active scanner attention even though no public exploit is currently catalogued in CISA KEV or Exploit-DB.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. An administrative function passes attacker-controlled values into a dynamically constructed query. Because the appliance database account runs with elevated privileges, the injected SQL is leveraged to write code or invoke functions that execute on the host operating system.

Attack Vector

The attacker must first obtain administrator credentials or hijack an authenticated administrator session through phishing, credential stuffing, or chaining a prior authentication flaw. Once authenticated, the attacker sends a crafted request to the vulnerable administrative endpoint over HTTPS. The injected payload manipulates the SQL query to trigger command execution on the underlying Linux or Windows host.

No verified public proof-of-concept code has been released for this CVE. Refer to the VMware Security Advisory VMSA-2022-0021 for technical details and impacted build numbers.

Detection Methods for CVE-2022-31659

Indicators of Compromise

Unexpected administrator logins to Workspace ONE Access or Identity Manager from unfamiliar IP ranges or outside business hours
New or modified files in appliance web application directories such as /opt/vmware/horizon/workspace/ or connector install paths
Outbound network connections from the appliance to non-VMware infrastructure, especially raw TCP shells or HTTP beacons
Anomalous child processes spawned by the Tomcat or Horizon service accounts (for example bash, sh, nc, python on Linux; cmd.exe, powershell.exe on Windows)

Detection Strategies

Hunt application logs for administrative API calls containing SQL metacharacters such as single quotes, UNION, SELECT, or stacked statements
Correlate administrator authentication events with subsequent process executions on the appliance host
Baseline outbound traffic from identity appliances and alert on deviations to new destinations or ports

Monitoring Recommendations

Forward Workspace ONE Access audit logs, Tomcat access logs, and OS-level process telemetry to a centralized SIEM
Monitor for modifications to JSP, JAR, and configuration files within the Workspace ONE Access application directory
Alert on creation of scheduled tasks, cron jobs, or systemd units on identity appliances

How to Mitigate CVE-2022-31659

Immediate Actions Required

Apply the patches listed in VMSA-2022-0021 to all Workspace ONE Access, Identity Manager, and Connector instances
Rotate administrator credentials, API tokens, and SAML signing certificates if compromise is suspected
Restrict network access to the appliance management interface to a small set of jump hosts or administrative subnets
Review administrator account inventory and remove unused or shared accounts

Patch Information

VMware released fixed builds for Identity Manager 3.3.4, 3.3.5, 3.3.6, Workspace ONE Access 21.08.0.0 and 21.08.0.1, and the associated connectors. Consult VMware Security Advisory VMSA-2022-0021 for the exact patch versions and KB articles applicable to each deployment.

Workarounds

Place the administrative console behind a VPN or bastion host and block direct internet exposure
Enforce multi-factor authentication (MFA) for all administrator accounts on Workspace ONE Access and Identity Manager
Implement web application firewall (WAF) rules to inspect administrative requests for SQL injection patterns until patching is complete

bash

# Example: restrict appliance management interface to an admin subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP