# Advisory: VMWare Workspace One UEM SSRF - CVE-2021-22054

Pre-auth SSRF in VMware Workspace ONE UEM BlobHandler.ashx via hardcoded encryption keys lets attackers proxy arbitrary internal requests and steal cloud metadata credentials.

- Payout: Research
- Severity: critical
- Program: VMware Workspace ONE UEM
- Credited: Assetnote
- Disclosed: 2024-01-08
- CVE: CVE-2021-22054
- Write-up quality: 6/10
- Original: https://www.assetnote.io/resources/research/advisory-vmware-workspace-one-uem-ssrf-cve-2021-22054
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-advisory-vmware-workspace-one-uem-ssrf-cve-2021-22054
- Tags: domain:web impact:data-leak impact:internal-access kind:research platform:research sev:critical tech:aws technique:source-review vuln:auth-bypass vuln:ssrf

**Target:** BlobHandler.ashx endpoint in AirWatch Console and Catalog web apps
**Root cause:** BlobHandler.ashx decrypts the Url parameter using hardcoded encryption parameters shipped in the product, so anyone can craft a valid encrypted URL and have the server fetch it.
**Steps:**
1. Identify BlobHandler.ashx in /Catalog/ and /AirWatch/ paths
2. Encrypt target URL (e.g. `http://169.254.169.254/latest/meta-data/`) with the hardcoded key/IV used by BlobHandler
3. Base64-encode the ciphertext and send `GET /Catalog/BlobHandler.ashx?Url=<blob>`
4. Read proxied response body returned by the server
**Exploitation:** Attacker crafts an encrypted Url blob using the hardcoded keys and requests BlobHandler.ashx; the server fetches the URL with arbitrary method/body and returns the response, enabling internal network pivoting and AWS metadata credential theft.
**Escalation:** Catalog app is often internet-exposed even when the AirWatch console is restricted, widening reach; SSRF can chain to cloud metadata for credential compromise.
**Insight:** Legacy .ashx handlers in enterprise consoles often carry hardcoded crypto for 'obfuscation' rather than security; grep shipped binaries/configs for static keys protecting URL or redirect parameters, then test the decrypt path as an SSRF sink.