2021-09-22 10:03:51 +00:00
id : CVE-2021-22005
2021-09-22 08:05:36 +00:00
info :
2022-05-09 16:12:52 +00:00
name : VMware vCenter Server - Arbitrary File Upload
2021-09-22 08:05:36 +00:00
author : PR3R00T
2021-09-22 10:03:51 +00:00
severity : critical
2022-05-09 16:12:52 +00:00
description : VMware vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
2023-09-06 12:09:01 +00:00
remediation : |
Apply the necessary security patches or updates provided by VMware
2021-09-22 10:03:51 +00:00
reference :
- https://kb.vmware.com/s/article/85717
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- https://core.vmware.com/vmsa-2021-0020-questions-answers-faq
2022-05-09 16:12:52 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-22005
2021-09-28 10:05:39 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-28 10:05:39 +00:00
cve-id : CVE-2021-22005
2023-08-31 11:46:18 +00:00
cwe-id : CWE-22
2023-11-03 15:51:18 +00:00
epss-score : 0.96983
2023-11-10 17:07:52 +00:00
epss-percentile : 0.99665
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : vmware
product : cloud_foundation
tags : cve,cve2021,vmware,vcenter,fileupload,kev,intrusive
2021-09-22 10:03:51 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-09-22 08:05:36 +00:00
- raw :
2021-09-22 10:03:51 +00:00
- |
GET / HTTP/1.1
Host : {{Hostname}}
2021-09-22 08:05:36 +00:00
- |
POST /analytics/telemetry/ph/api/hyper/send?_c&_i=test HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
test_data
2021-09-22 10:03:51 +00:00
req-condition : true
2021-09-22 08:05:36 +00:00
matchers :
2021-09-22 10:03:51 +00:00
- type : dsl
dsl :
- "status_code_1 == 200"
- "status_code_2 == 201"
- "contains(body_1, 'VMware vSphere')"
- "content_length_2 == 0"
2022-01-04 19:34:16 +00:00
condition : and
2023-11-11 17:50:28 +00:00
# digest: 490a00463044022075045c75664e29bb7585482ae351d83802dab8ef62d1dcc6900b5e4dace4ee0d02201b5600dd116ce161e020ea311ee6cd08a57c62680cc77cb86c2e109c7bb2cfae:922c64590222798bb761d5b6d8e72950
