CISA KEV Update: SolarWinds, Ivanti, and Workspace One Flaws Under Active Attack

Monday brought a stark reminder to defenders everywhere: the gap between disclosure and exploitation is closing rapidly. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three critical security flaws to its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively abusing these bugs in the wild. For organizations relying on SolarWinds, Ivanti, or Workspace One platforms, the time for action is not "soon"—it is now.

The Threat Landscape

When CISA adds a vulnerability to the KEV catalog, it is not a theoretical warning; it is an intelligence-based directive indicating that active exploitation has been observed. This latest update focuses on enterprise management solutions—tools that sit at the heart of network infrastructure. These platforms are prime targets because compromising them provides attackers with high-level privileges and extensive access to managed endpoints.

One of the highlighted flaws, CVE-2021-22054 (CVSS 7.5), affects Omnissa Workspace One UEM (formerly VMware Workspace One UEM). This is a Server-Side Request Forgery (SSRF) vulnerability. While SSRF might sound like a low-impact issue compared to Remote Code Execution (RCE), in a unified endpoint management context, it is devastating. It allows an attacker to force the application to make requests to internal or external resources of the attacker's choosing. This can be used to scan internal networks, access metadata services (like AWS IMDS), or pivot to other critical systems that trust the UEM server.

Technical Deep Dive: CVE-2021-22054

The vulnerability in Workspace One UEM stems from improper validation of user-supplied input. By crafting a malicious request, an authenticated attacker can coerce the server into sending HTTP requests to arbitrary destinations.

The Attack Vector:

1. Reconnaissance: The attacker uses the SSRF to query internal IP ranges and map the network topology behind the firewall.
2. Data Exfiltration: If sensitive internal services are accessible (e.g., admin consoles, databases), the attacker can relay data through the vulnerable UEM server.
3. Cloud Metaprovider Access: If the UEM server is hosted in the cloud, attackers often target the instance metadata service (169.254.169.254) to steal temporary credentials, allowing them to move laterally into the cloud environment.

Detection and Threat Hunting

Given the active exploitation status, Security Operations Centers (SOCs) must hunt for signs of compromise related to these platforms. For CVE-2021-22054, we look for suspicious outbound network traffic originating from the UEM server infrastructure.

KQL Queries (Microsoft Sentinel)

Hunt for outbound connections from known Workspace One UEM servers to internal private IP ranges or unusual external endpoints.

let WorkspaceOneServers = dynamic(["10.0.0.5", "192.168.1.10"]); // Add your UEM server IPs
DeviceNetworkEvents
| where InitiatingProcessFileName has_any ("java", "tomcat", "httpd")
| where DeviceIP in (WorkspaceOneServers)
| where RemoteIPType == "Private" or RemoteIPType == "Reserved"
| where RemotePort != 443 and RemotePort != 80 // Allow standard web traffic
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| summarize count() by RemoteIP, DeviceName
| order by count_ desc

Hunt for specific suspicious User-Agent strings or anomalous URI lengths often associated with SSRF payloads.

DeviceNetworkEvents
| where DeviceName contains "WS1" // Adjust based on naming convention
| where RemoteUrl contains "169.254.169.254" or RemoteUrl contains "metadata"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, InitiatingProcessCommandLine

Bash Script (Log Analysis)

If you have access to the underlying Linux logs for the Workspace One UEM appliance, you can grep for suspicious patterns in the access logs.

#!/bin/bash
# Hunt for potential SSRF patterns in access logs
LOG_FILE="/var/log/apache2/access.log"

# Check for requests to private IP ranges (RFC1918)
grep -E "GET|POST" "$LOG_FILE" | grep -E "(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)" | tail -n 20

# Check for requests to localhost loopback
grep "127.0.0.1" "$LOG_FILE" | tail -n 10

# Check for suspicious URL parameters often used in SSRF (e.g., url=, dest=, target=)
grep -iE "url=|dest=|target=|redirect=" "$LOG_FILE" | tail -n 20

Mitigation Strategies

1. Patch Immediately: Apply the vendor-provided patches for CVE-2021-22054 and the other associated CVEs for SolarWinds and Ivanti. Federal Civilian Executive Branch (FCEB) agencies have a deadline; private sector entities should treat themselves with the same urgency.

2. Network Segmentation: Ensure that your UEM servers cannot initiate arbitrary connections to the internal network. Implement strict egress filtering. The management plane should only be able to speak to the endpoints it manages and necessary dependencies.

3. Disable Unused Integrations: Review your Workspace One, SolarWinds, and Ivanti integrations. If an integration is not actively used, disable it to reduce the attack surface.

4. Audit Access Logs: Review logs for the period leading up to the patch application. Look for the indicators of compromise mentioned above to determine if the vulnerability was exploited prior to patching.

Conclusion

The addition of these vulnerabilities to the CISA KEV catalog serves as a critical alert. Management tools like Workspace One, SolarWinds, and Ivanti are the keys to the kingdom for attackers. Defenders must move quickly to patch, hunt for signs of intrusion, and tighten network controls around these essential platforms.

Related Resources

Security Arsenal Alert Triage Automation AlertMonitor Platform Book a SOC Assessment platform Intel Hub