CISA urges VMware admins to patch important flaw in Workspace ONE UEM

CISA has requested VMware admins and customers at the moment to patch a important safety vulnerability discovered within the Workspace ONE UEM console that menace actors might abuse to realize entry to delicate info.

Workspace ONE Unified Endpoint Administration (ONE UEM) is a VMware answer for over-the-air distant administration of desktops, cell, rugged, wearables, and IoT gadgets.

The flaw tracked as CVE-2021-22054 is a server aspect request forgery (SSRF) vulnerability with a severity score of 9.1/10 and impacting a number of ONE UEM console variations.

Unauthenticated menace actors can exploit this vulnerability remotely in low-complexity assaults with out person interplay.

“A malicious actor with community entry to UEM can ship their requests with out authentication and should exploit this situation to realize entry to delicate info,” VMware defined in a safety advisory issued on Thursday.

“CISA encourages customers and directors to overview VMware Safety Advisory VMSA-2021-0029 and apply the mandatory mitigation,” CISA mentioned at the moment.

Workaround out there

VMware additionally gives short-term mitigation to dam exploitation makes an attempt should you can not instantly deploy one of many patched variations within the above desk.

The momentary workaround requires you to edit the UEM internet.config file by following the steps outlined right here and restarting all server cases on which this workaround has been utilized.

VMware additionally gives steps to validate that the workaround will efficiently block assaults utilizing CVE-2021-22054 exploits.

To check if the workaround was accurately utilized, it’s important to open an online browser and navigate to those URLs (it is best to solely get 404 Not Discovered responses):

https://[UEM Console URL]/airwatch/blobhandler.ashx?url=check
https://[UEM Console URL]/catalog/blobhandler.ashx?url=check
https://[UEM Console URL]/airwatch/blobhandler.ashx?param1=check&url=check
https://[UEM Console URL]/catalog/blobhandler.ashx?param1=check&url=check

“IIS reset will trigger logged-in directors to the server occasion being patched to sign off. Directors ought to be capable of log again in shortly after,” VMware says.