2021-09-22 10:03:51 +00:00
id : CVE-2021-22005
2021-09-22 08:05:36 +00:00
info :
2022-05-09 16:12:52 +00:00
name : VMware vCenter Server - Arbitrary File Upload
2021-09-22 08:05:36 +00:00
author : PR3R00T
2021-09-22 10:03:51 +00:00
severity : critical
2022-05-09 16:12:52 +00:00
description : VMware vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
2023-09-27 15:51:13 +00:00
impact : |
Allows an attacker to upload and execute arbitrary files on the target system
2023-09-06 12:09:01 +00:00
remediation : |
Apply the necessary security patches or updates provided by VMware
2021-09-22 10:03:51 +00:00
reference :
- https://kb.vmware.com/s/article/85717
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- https://core.vmware.com/vmsa-2021-0020-questions-answers-faq
2022-05-09 16:12:52 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-22005
2024-01-29 17:11:14 +00:00
- https://github.com/ARPSyndicate/kenzer-templates
2021-09-28 10:05:39 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-28 10:05:39 +00:00
cve-id : CVE-2021-22005
2023-08-31 11:46:18 +00:00
cwe-id : CWE-22
2024-05-31 19:23:20 +00:00
epss-score : 0.97396
epss-percentile : 0.99916
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : vmware
product : cloud_foundation
2024-01-14 09:21:50 +00:00
tags : cve2021,cve,vmware,vcenter,fileupload,kev,intrusive
2021-09-22 10:03:51 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-09-22 08:05:36 +00:00
- raw :
2021-09-22 10:03:51 +00:00
- |
GET / HTTP/1.1
Host : {{Hostname}}
2021-09-22 08:05:36 +00:00
- |
POST /analytics/telemetry/ph/api/hyper/send?_c&_i=test HTTP/1.1
Host : {{Hostname}}
Content-Type : application/json
test_data
matchers :
2021-09-22 10:03:51 +00:00
- type : dsl
dsl :
- "status_code_1 == 200"
- "status_code_2 == 201"
- "contains(body_1, 'VMware vSphere')"
- "content_length_2 == 0"
2022-01-04 19:34:16 +00:00
condition : and
2024-06-01 06:53:00 +00:00
# digest: 4b0a00483046022100e3cdb9bdf44186d52c6da410d81899c0228cc759fd45b311962db3edb8df80ee022100b6a85324e12cc4066bcd4f206f9ad888057aa8d4f0de24c90db0c5e32046ac9f:922c64590222798bb761d5b6d8e72950