VMware Server-Side Template Injection Attempt (CVE-2022-22954)

The analytic identifies potential server-side template injection attempts related to CVE-2022-22954. It detects suspicious URL patterns containing "deviceudid" and keywords like "java.lang.ProcessBuilder" or "freemarker.template.utility.ObjectConstructor" using web or proxy logs. This activity may indicate an attempt to exploit a known vulnerability in VMware, potentially leading to remote code execution.