CVE-2022-22954

Successful exploitation compromises the confidentiality, integrity, and availability of resources accessible to the VMware service account. Attackers can execute commands, access accessible application data and configuration, deploy webshells and malware, and establish a foothold for subsequent intrusion activity. Observed exploitation includes Dingo J-spy and Godzilla webshell deployment, botnet installation, cryptocurrency mining, and SSH key manipulation. CVE-2022-22954 does not independently grant root privileges; attackers have chained it with the separate local privilege escalation vulnerability CVE-2022-22960 to obtain full system control and steal credentials and application secrets.

Where immediately patching is not possible, apply the applicable vendor temporary workaround documented in KB88098. Remove vulnerable instances from the network if they cannot be promptly secured, and restrict web-interface access to trusted networks. Treat affected internet-facing systems that were not promptly patched as potentially compromised and conduct threat hunting for template-injection requests, unexpected command execution, webshell creation, and anomalous service-account or root activity. Isolate confirmed compromised systems and preserve evidence. Network exploit signatures and endpoint detections provide supplementary coverage but do not replace patching.

Apply the component-specific patches identified in VMware advisory VMSA-2022-0011.2 and knowledge base article KB88099. Patch vulnerable Workspace ONE Access and Identity Manager components, including those deployed through VMware Cloud Foundation or vRealize Suite Lifecycle Manager. vRealize Automation 8.x itself is unaffected, but a separately deployed vulnerable Identity Manager used with it requires patching directly. Explicit fixed version numbers are not specified here. For systems that were exposed while unpatched, investigate for compromise and remove attacker persistence; patching alone does not eradicate an existing intrusion.