Omnissa Workspace ONE UEM Server-Side Request Forgery (CVE-2021-22054)
Detects exploitation of CVE-2021-22054, a Server-Side Request Forgery (SSRF) vulnerability in Omnissa (formerly VMware) Workspace ONE UEM. An unauthenticated attacker can send crafted HTTP requests to the UEM server, causing it to make arbitrary outbound HTTP/HTTPS requests to internal or external resources. This can be leveraged to scan internal networks, access cloud metadata services (e.g., AWS IMDS), or pivot to internal services not directly reachable by the attacker. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
Vulnerability Intelligence
KEV — Known ExploitedAffected Software
- Vendor
- Omnissa
- Product
- Workspace One UEM
Weakness (CWE)
Timeline
- Disclosed
- March 9, 2026
CVSS
What is CVE-2021-22054 Omnissa Workspace ONE UEM Server-Side Request Forgery (CVE-2021-22054)?
Omnissa Workspace ONE UEM Server-Side Request Forgery (CVE-2021-22054) (CVE-2021-22054) maps to the Reconnaissance and Discovery and Lateral Movement tactics — the adversary is trying to gather information they can use to plan future operations in MITRE ATT&CK.
This page provides production-ready detection logic for Omnissa Workspace ONE UEM Server-Side Request Forgery (CVE-2021-22054), covering the data sources and telemetry it touches: CommonSecurityLog, W3CIISLog, DeviceNetworkEvents. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
let ssrf_indicators = dynamic(["169.254.169.254", "metadata.google.internal", "100.100.100.200", "localhost", "127.0.0.1", "::1"]);
let workspace_one_paths = dynamic(["/DeviceManagement/", "/AirWatch/", "/API/", "/mGroups/"]);
let time_window = 1h;
union
(
CommonSecurityLog
| where TimeGenerated >= ago(time_window)
| where DeviceProduct has_any ("Workspace ONE", "AirWatch", "VMware UEM")
| where RequestURL has_any (ssrf_indicators) or DestinationHostName has_any (ssrf_indicators)
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestURL, Activity, DeviceProduct, AdditionalExtensions
),
(
W3CIISLog
| where TimeGenerated >= ago(time_window)
| where csUriStem has_any (workspace_one_paths)
| where csUriQuery has_any (ssrf_indicators) or csReferer has_any (ssrf_indicators)
| project TimeGenerated, cIP, csMethod, csUriStem, csUriQuery, scStatus, csHost
),
(
DeviceNetworkEvents
| where TimeGenerated >= ago(time_window)
| where InitiatingProcessFileName has_any ("Airwatch", "AwApi", "UEM")
| where RemoteUrl has_any (ssrf_indicators) or RemoteIP in ("169.254.169.254", "127.0.0.1")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType
)
| extend AlertSeverity = "High"
| extend CVE = "CVE-2021-22054"
| order by TimeGenerated descDetects SSRF exploitation attempts against Workspace ONE UEM by correlating IIS web logs, CommonSecurityLog entries, and network events for requests targeting internal metadata services or loopback addresses initiated from or through the UEM process.
Data Sources
Required Tables
False Positives
- Legitimate health check processes that probe internal endpoints from the UEM server
- Vulnerability scanners or internal security tools targeting the UEM server during authorized assessments
- Misconfigured integrations that inadvertently send requests to loopback or link-local addresses
- Load balancer or proxy health probes that surface as internal IP requests in web logs
Sigma rule & cross-platform mapping
The detection logic for Omnissa Workspace ONE UEM Server-Side Request Forgery (CVE-2021-22054) (CVE-2021-22054) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: network_connection
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for CVE-2021-22054
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1SSRF via Workspace ONE UEM Unauthenticated Endpoint to IMDS
Expected signal: IIS access log entry for /DeviceManagement/enrollment with url= parameter containing 169.254.169.254; outbound network connection from UEM server to 169.254.169.254:80
- Test 2SSRF Internal Network Port Scan via Workspace ONE UEM
Expected signal: Multiple IIS log entries within seconds for /AirWatch/ paths with url= parameters containing RFC1918 addresses on varying ports; timing differences in responses reveal open vs closed ports
- Test 3SSRF to Internal Administrative Interface via Redirect Parameter
Expected signal: IIS log entry with redirect= parameter pointing to internal host; potential Windows Defender firewall log showing outbound connection from UEM process to internal admin host; Sysmon Event ID 3 network connection from IIS worker process (w3wp.exe) to internal IP
- Test 4SSRF File URI Scheme Attempt for Local File Read
Expected signal: IIS log entry with file:// URI in URL parameter; absence of outbound network connection (file read is local); potential application error log entries if file:// is rejected by URL validation
Unlock Pro Content
Get the full detection package for CVE-2021-22054 including response playbook, investigation guide, and atomic red team tests.