VMware vCenter public PoC CVE-2021-21986

The Proof-of-Concept exploit allows an unauthenticated attacker to download arbitrary files from the VMware vCenter server, or access arbitrary websites via de VMware vCenter server.

Based on the information provided by VMware in Advisory VMSA-2021-0010, the following versions are vulnerable:

• VMware vCenter prior to 7.0 U2b
• VMware vCenter prior to 6.7 U3n
• VMware vCenter prior to 6.5 U3p

What can I do to reduce or stop potential damage?

VMware published a patch on the 25^th of May 2021, applying the patch as soon as possible is advisable. In case applying the patch is not possible, a workaround is available in KB83829.

In general, it is strongly recommended to limit access to the VMware vCenter web interface and to not expose the service to the internet.

The exploit described the following attack techniques:

• Unauthenticated arbitrary file read – This allows an attacker to download arbitrary files from the local disk. Based on our analysis this appears to be limited in scope to the user vsphere-ui which is member of the group users.
• Unauthenticated server-side request forgery (SSRF) – This allows an attacker to access web pages or web portals from the VMware vCenter server. This may lead to privilege escalation or be used for lateral movement.
• Unauthenticated cross-site scripting (XSS) – In combination with the SSRF vulnerability, an attacker can access a web page containing its JavaScript files, leading to a XSS vulnerability.

We believe this exploit may be related to CVE-2021-21986 based on the following observations:

• VMware vCenter version 7.0.2.00100 (build 17920168 – update 2a) appears to be the last vulnerable version. As of version 7.0.2.00200 (build 17958471 – update 2b), the Proof-of-Concept exploit no longer works.
• Applying the workaround, specifically for the “VMware Cloud Director Availability” plugin, as described in KB83829 prevents the Proof-of-Concept exploit to work.
• CVE-2021-21986 describes a vulnerability in the authentication mechanism of specific plug-ins, including the “VMware Cloud Director Availability” plugin. The URL used in the Proof-of-Concept exploit is related to the “VMware Cloud Director Availability” plugin.
• Once the patch or workaround is applied, the Proof-of-Concept exploit no longer functions and a “HTTP Status 401 – Unauthorized” message is returned from vCenter.

More information:

• PoC exploit
• VMware Advisory VMSA-2021-0010
• VMware Advisory VMSA-2021-0027
• VMware KB83829 – workaround CVE-2021-21986