# Understanding CVE-2022-22972 (VMWare Workspace One Access Auth Bypass)

Workspace One Access local password adapter builds its auth-check URL from the attacker-controlled Host header, so pointing it at an attacker server that returns 200 bypasses authentication.

- Payout: Research
- Severity: critical
- Program: VMware Workspace One Access
- Credited: Assetnote
- Disclosed: 2024-01-31
- CVE: CVE-2022-22972
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass
- Tags: domain:web impact:ato impact:internal-access kind:research platform:research sev:critical tech:java technique:chained technique:source-review vuln:auth-bypass vuln:host-header

**Target:** Java web app embedded auth broker / local password auth adapter
**Root cause:** LocalPasswordAuthAdapter.getLocalUrl() constructs the internal auth endpoint using request.getServerName() (the Host header), and LocalPasswordService.authenticate() treats any HTTP 200 from that endpoint as successful authentication.
**Steps:**
1. Decompile SAAS/WEB-INF/classes (LoginController) and /usr/local/horizon/lib/embeddedauthadapters/local-password-auth-adapter-0.1.jar
2. Trace LoginController -> federationBrokerService.doEmbeddedAuthBrokerLogin -> LocalPasswordAuthAdapter.login
3. Note line 168: endpoint = getLocalUrl(request) uses request.getServerName() (Host header)
4. Note line 170: getLocalPasswordService(config).authenticate(endpoint, ...) POSTs credentials to that endpoint
5. Host an attacker server returning HTTP 200 to POST /SAAS/auth/login/embeddedauthbroker/callback
6. Send `POST /SAAS/auth/login/embeddedauthbroker/callback` with `Host: attacker.example` and any username/password
7. LocalPasswordService receives 200 from attacker server and returns authenticated=true, issuing a session
**How found:** Set up vulnerable appliance, tailed /opt/vmware/horizon/workspace/logs while replaying the PoC, saw LoginController and LocalPasswordAuthAdapter log lines, decompiled the relevant JARs (noting LoginController lived in WEB-INF/classes, not the lib JARs), and traced source-to-sink from getServerName() to httpClient.execute().
**Exploitation:** Attacker controls the Host header so the appliance's own credential-validation request is sent to an attacker-controlled server; that server replies 200, causing the adapter to mark the login successful and grant an authenticated session without valid credentials.
**Insight:** When auditing Java enterprise apps, decompile WEB-INF/classes and every embedded adapter JAR, not just WEB-INF/lib; and treat request.getServerName() as attacker-controlled Host input whenever it feeds an outbound URL whose response gates an auth decision.