Cyritex Attack Simulation Library | Attack Simulation Update for Two Recent Critical Vulnerabilities in VMware!

In April and May this year, VMware officially released two security advisories addressing vulnerabilities in multiple VMware products, including two critical vulnerabilities with a CVSS score of 9.8: CVE-2022-22954 and CVE-2022-22972.
In response to CVE-2022-22972, the Cybersecurity and Infrastructure Security Agency (CISA) under the U.S. Department of Homeland Security simultaneously issued an emergency directive requiring federal executive agencies to patch the vulnerability within 5 days.

▌Vulnerability Introduction

CVE-2022-22954 is due to a server-side template injection vulnerability in VMware Workspace ONE Access and Identity Manager, allowing malicious actors with network access to perform remote code execution. Attackers have exploited this vulnerability to infect servers for cryptocurrency mining.

CVE-2022-22972 has a flaw in authentication processing. Remote attackers can bypass authentication by forging relevant request information, thereby obtaining administrative privileges for the associated applications. Currently, this vulnerability has not been found to be exploited in the wild, but attackers have begun to implement revised attacks and attempt to plant cryptocurrency mining trojans.

▌Attack Simulation Library Update

You can already choose attacks based on these two high-risk vulnerabilities on our platform to conduct attack simulations between designated areas, in order to test your security architecture's detection and defense capabilities against these two types of attacks. In this way, even if you have not patched the vulnerabilities for various reasons, you can confirm whether the perimeter defenses can detect and defend through our attack simulation, achieving the goal of keeping enemies outside the gate. Through repeated and continuous simulation and verification, you can also discover cases where attacks that can be defended against now become undefendable after changes due to the drift of security capabilities.