VMware Workspace ONE Access / Identity Manager CVE-2022-22954 (server-side template injection RCE, CVSS 9.8, CISA KEV, VMSA-2022-0011): which versions are affected and how do I patch or mitigate?

What it is: CVE-2022-22954, published in VMware advisory VMSA-2022-0011 in April 2022, is a server-side template injection flaw in VMware Workspace ONE Access and VMware Identity Manager (vIDM). An unauthenticated attacker with network access to the web interface can run code on the appliance. VMware confirmed exploitation in the wild days after release (crypto miners, backdoors and ransomware access followed), and it's in CISA's KEV catalog. These appliances handle single sign-on, so a compromise can expose identities across many applications. Am I affected: - Workspace ONE Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0; VMware Identity Manager 3.3.3-3.3.6; and the vIDM component used by VMware Cloud Foundation 4.x and vRealize Suite Lifecycle Manager 8.x. - vRealize Automation 8.x doesn't embed vIDM; if it's deployed with a separate vIDM, patch that vIDM. - These product lines are old; check what you run in the appliance admin console. Fix: 1. Apply the fix from VMware/Broadcom KB88099 (or move to a currently supported identity product/version). Patch every node of a cluster. 2. If you can't patch immediately, VMware's documented workaround is KB88098; it's temporary. 3. Keep the admin and user portals off the public internet where possible, or behind a VPN/reverse proxy with access control. 4. Because exploitation was widespread, treat any vulnerable appliance that was internet-facing as possibly compromised: look for unexpected processes, files and accounts on the appliance, rebuild from a clean image if in doubt, and rotate what it held: local and directory service accounts, connector and integration credentials, SAML/OIDC signing certificates, and admin passwords. Verify: the appliance reports the patched build from KB88099, the workaround is removed after patching if the KB says so, and old signing certificates and integration credentials have been replaced. Sources: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23639 https://nvd.nist.gov/vuln/detail/CVE-2022-22954 https://www.cisa.gov/known-exploited-vulnerabilities-catalog