# Encrypting our way to SSRF in VMWare Workspace One UEM (CVE-2021-22054)

Pre-auth SSRF in VMware Workspace One UEM's BlobHandler.ashx proxies arbitrary HTTP requests after decrypting attacker URLs with hardcoded default master keys.

- Payout: Real-world hack
- Severity: critical
- Program: VMware Workspace ONE UEM
- Credited: Assetnote
- Disclosed: 2024-01-02
- CVE: CVE-2021-22054
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054
- Tags: domain:web impact:data-leak impact:internal-access kind:incident platform:research sev:critical tech:aws tech:dotnet technique:chained technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:ssrf

**Target:** ASP.NET BlobHandler.ashx endpoint (Catalog and AirWatch routes)
**Root cause:** BlobHandler.ashx decrypts a user-supplied Url parameter and proxies it server-side; the MasterKeyResolver falls back to a hardcoded DefaultMasterKey (kv0) when keyVersion is 'kv0' or null, letting attackers encrypt arbitrary URLs.
**Steps:**
1. Locate web.config entries allowing anonymous access to BlobHandler.ashx
2. Decompile WanderingWiFi.AirWatch.Console.Web and trace BlobHandler -> DataEncryption.DecryptString -> GetDecryptorsForCipherText -> MasterKeyResolver.GetMasterKey
3. Note GetMasterKey returns DefaultMasterKey when keyVersion is 'kv0' or null, with hardcoded Passphrase and SaltData
4. Build C# tool calling DataEncryption.EncryptString(url, null) and base64-encode the Unicode bytes
5. Send `GET /Catalog/BlobHandler.ashx?Url=<base64>` (or `/AirWatch/BlobHandler.ashx`) to trigger SSRF
6. Point Url at `http://169.254.169.254/latest/meta-data/` to read AWS metadata
**How found:** Started by auditing web.config route mappings in the .NET UEM deployment, spotted BlobHandler.ashx with `<allow users="*"/>`. Decompiled the DLL in ILSpy, noticed custom DataEncryption.DecryptString, traced through Decrypt/GetDecryptorsForCipherText to MasterKeyResolver and found the hardcoded DefaultMasterKey fallback for kv0.
**Exploitation:** Attacker encrypts an arbitrary URL with the hardcoded kv0 master key, base64-encodes it, and passes it as the Url query parameter to the unauthenticated BlobHandler.ashx. The server decrypts and proxies the request, returning the response body to the attacker. Arbitrary HTTP methods and bodies are supported, enabling access to internal services and AWS IMDS.
**Escalation:** Chained SSRF to AWS metadata to obtain IAM role credentials with significant access to the AWS environment, breaching customers and Fortune 500 companies.
**Insight:** When auditing .NET apps, grep web.config for `<allow users="*"/>` on .ashx handlers, then trace any custom crypto to its key resolver — a 'default key version' fallback branch often means hardcoded keys you can encrypt with.