2021-09-22 10:03:51 +00:00
id : CVE-2021-22005
2021-09-22 08:05:36 +00:00
info :
2022-05-09 16:12:52 +00:00
name : VMware vCenter Server - Arbitrary File Upload
2021-09-22 08:05:36 +00:00
author : PR3R00T
2021-09-22 10:03:51 +00:00
severity : critical
2022-05-09 16:12:52 +00:00
description : VMware vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
2023-09-06 12:09:01 +00:00
remediation : |
Apply the necessary security patches or updates provided by VMware
2021-09-22 10:03:51 +00:00
reference :
- https://kb.vmware.com/s/article/85717
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- https://core.vmware.com/vmsa-2021-0020-questions-answers-faq
2022-05-09 16:12:52 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-22005
2021-09-28 10:05:39 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-28 10:05:39 +00:00
cve-id : CVE-2021-22005
2023-08-31 11:46:18 +00:00
cwe-id : CWE-22
2023-10-22 12:16:24 +00:00
epss-score : 0.97096
2023-10-31 18:27:55 +00:00
epss-percentile : 0.99699
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : vmware
product : cloud_foundation
tags : cve,cve2021,vmware,vcenter,fileupload,kev,intrusive
2021-09-22 10:03:51 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-09-22 08:05:36 +00:00
- raw :
2021-09-22 10:03:51 +00:00
- |
GET / HTTP/1.1
Host : {{Hostname}}
2021-09-22 08:05:36 +00:00
- |
POST /analytics/telemetry/ph/api/hyper/send?_c&_i=test HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
test_data
2021-09-22 10:03:51 +00:00
req-condition : true
2021-09-22 08:05:36 +00:00
matchers :
2021-09-22 10:03:51 +00:00
- type : dsl
dsl :
- "status_code_1 == 200"
- "status_code_2 == 201"
- "contains(body_1, 'VMware vSphere')"
- "content_length_2 == 0"
2022-01-04 19:34:16 +00:00
condition : and
2023-11-01 14:45:21 +00:00
# digest: 4a0a0047304502201aee6af12dec34d37b7e8ac0010b55bcb55aeee1da57c3cd649dd950483c4e9f0221008f8b8080ef71f59748b87b2a867cb30d9369d7fa131d23157ec2bb08a37d1f74:922c64590222798bb761d5b6d8e72950
