Advisory ID<\/strong>: usd-2021-0009 The following behavior was reported to VMware in March 2021. After finishing their investigations, VMware informed us that they do not agree that their dynamic compromise detection would violate app store policies regarding run-time code retrieval and execution. Please find their detailed statement here: https:\/\/code.vmware.com\/docs\/13894\/StatementDeviceCompromiseDetection.pdf<\/a>.<\/p>\n The VMware Workspace ONE Intelligent Hub Apps for Android and iOS implement and use a mechanism to dynamically load remote code and execute it on mobile phones without indication to end users.<\/p>\n According to Google\u2019s Developer Program Policy<\/a>, a backdoor is \u201ecode that allows the execution of unwanted, potentially harmful, remote-controlled operations on a device\u201c. \u00a0The VMware Hub applications implement a Dynamic Compromise Detection<\/em> mechanism for which JavaScript code is downloaded from external endpoints and then executed in the application context. Further, native interfaces are exposed to the JavaScript code offering the ability to directly run OS commands.<\/p>\n <\/span><\/p>\n The Workspace ONE Intelligent Hub Apps download remote contents from the following\u00a0endpoints:<\/p>\n The following request and response illustrate the communication with these endpoints:<\/p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" custom_margin=\"20px||29px||false|false\" global_colors_info=\"{}\"] GET \/api\/v1\/sdk\/compliance\/rules\/an5r0i5payl0adg3n3rat0R HTTP\/1.1 Response:<\/span><\/p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" custom_margin=\"20px||29px||false|false\" global_colors_info=\"{}\"] HTTP\/1.1 200 { The payload consists of a PKCS#7<\/em> encoded and signed blob. During our assessment it was not possible to bypass the signature validation and inject malicious code.This payload can be decoded using OpenSSL<\/em>, an exemplary excerpt of the downloaded JavaScript code is presented in $ cat payload.b64 | base64 -d > payload.txt Excerpt of decoded payload:<\/p>\n<\/div>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" custom_margin=\"20px||29px||false|false\" global_colors_info=\"{}\"] [...] \u00a0 [...] As the above snippet shows, the application provides native interfaces to the JavaScript code. For instance, the native_Exec()<\/strong> function appears to be a wrapper for the C function system()<\/strong>\u00a0which allows the execution of arbitrary operating system commands.<\/p>\n The aforementioned mechanism enables VMware to run arbitrary commands which are retrieved from external resources on the user\u2019s device, resulting in backdoor capabilities. <\/p>\n<\/div>[\/et_pb_text][et_pb_text _builder_version=\"4.13.1\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"] It is recommended to follow Apple's and Google's guidelines regarding secure app development and distribution. Further, it is recommended to include the entire code within the application bundle.<\/span><\/p>\n <\/span><\/p>\n
Affected Product<\/strong>: VMware Workspace ONE Intelligent Hub
Affected Version<\/strong>:<\/span><\/strong> 21.01.0.24 (Android) and 21.01.0 (Build d3dd95e, iOS)
<\/span>Vulnerability Type<\/strong>: CWE-912: Hidden Functionality (Backdoor)
<\/span>Security Risk<\/strong>: MEDIUM (CVSS:3.0\/AV:N\/AC:H\/PR:H\/UI:R\/S:U\/C:H\/I:H\/A:H)
Vendor URL<\/strong>: https:\/\/www.VMware.com\/de\/products\/workspace-one\/intelligent-hub.html<\/a>
Vendor Status<\/strong>: Not fixed \/ Disputed<\/p>\n<\/h3>\n
Description<\/h3>\n
Apple\u2019s Software Requirements<\/a> for apps enforce that \u201eapps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps\u201c.<\/p>\nProof of Concept (PoC)<\/h3>\n
\n
Host: api.na1.region.data.vmwservices.com
[...]<\/p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]
Date: Tue, 02 Mar 2021 12:33:29 GMT
Content-Type: application\/json
Connection: close
vary: accept-encoding
Content-Length: 13719<\/p>\n
\"data\" : {
\"id\" : \"an5r0i5payl0adg3n3rat0R\",
\"rules\" : {
\"payload\" : \"MIInbAYJKoZIhvcNAQcCoIInXTCCJ1kCAQE[...]\"<\/strong>,
\"payloadVersion\" : \"1\"
},
\"created_at\" : 1588726763166,
\"created_by\" : \"thor\",
\"modified_at\" : 1588786684777,
\"modified_by\" : \"thor\"
}
}<\/p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" custom_margin=\"||27px||false|false\" global_colors_info=\"{}\"]
the following:<\/p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" custom_margin=\"20px||29px||false|false\" global_colors_info=\"{}\"]
$ openssl asn1parse -inform der -in payload.txt -dump<\/p>[\/et_pb_text][et_pb_text _builder_version=\"4.13.1\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" custom_margin=\"||27px||false|false\" global_colors_info=\"{}\"]
function u() {
\u00a0 var t = [], s = native_Exec(\"id\")<\/strong>;
\u00a0 if (null != s && s.length > 0)
\u00a0 \u00a0 \u00a0for (i = 0; i < s.length; i++)
\u00a0 \u00a0 \u00a0 \u00a0-1 != s[i].indexOf(\"(root)\") && (t.push(\"90413-1\"),
\u00a0 \u00a0 \u00a0k(\"E\", \"Root detected code 90413-1\"));
\u00a0 \u00a0 \u00a0return null != (s = native_Exec(\"su -c ls\")<\/strong>) && s.length > 0 && (t.push(\"90411-1\"),
\u00a0 \u00a0 \u00a0 \u00a0k(\"E\", \"Root detected code 90411-1\")),
\u00a0 \u00a0 \u00a0 \u00a0null != (s = native_Exec(\"su\")<\/strong>) && s.length > 0 && (t.push(\"90412-1\"),<\/p>\n
}
[...]<\/p>[\/et_pb_text][et_pb_text _builder_version=\"4.13.1\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" custom_margin=\"||27px||false|false\" global_colors_info=\"{}\"]Fix<\/span><\/span><\/h3>\n
References<\/h3>\n