Webserver attempts exploiting CVE-2022-31656 in VMware Workspace ONE Access

Alerts on webserver requests to Workspace ONE Access containing a URI query pattern linked to CVE-2022-31656 exploitation.

FreeUnreviewedSigmahighv1

webserver-attempts-exploiting-cve-2022-31656-in-vmware-workspace-one-access-fcf1101d

title: Webserver attempts exploiting CVE-2022-31656 in VMware Workspace ONE Access
id: 85527c23-c9c8-44bc-a87f-9b41dd618cc3
status: test
description: This rule flags HTTP requests to VMware Workspace ONE Access that contain a specific suspicious URI query fragment associated with CVE-2022-31656 exploitation. Authentication bypass attempts matter because they can allow attackers with UI network access to reach privileged functionality without valid credentials. Detection relies on webserver telemetry, specifically the presence of the targeted substring in the request URL query.
references:
  - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-31656/web_cve_2022_31656_auth_bypass.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-31656
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: /SAAS/t/_/;/
  condition: selection
falsepositives:
  - Vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: fcf1101d-07c9-49b2-ad81-7e421ff96d80
    type: derived

What it detects

This rule flags HTTP requests to VMware Workspace ONE Access that contain a specific suspicious URI query fragment associated with CVE-2022-31656 exploitation. Authentication bypass attempts matter because they can allow attackers with UI network access to reach privileged functionality without valid credentials. Detection relies on webserver telemetry, specifically the presence of the targeted substring in the request URL query.

Known false positives

Vulnerability scanners

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.