CVE-2021-21972criticalunder attackransomwareCWE-22

CVE-2021-21972: critical vulnerability in VMware vCenter Server

Published · Updated

Follow this CVE+ Monitor VMware Cloud Foundation+ Monitor vCenter Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDFeb 24
1st PoCMar 11
metasploitFeb 23
CISA KEV+252d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A flaw in VMware vCenter Server allows attackers on the network to run unauthorized commands with full control over the server. This is a critical vulnerability that affects multiple versions of vCenter and Cloud Foundation.

Technical detail

The vSphere Client (HTML5) plugin in vCenter Server contains a path traversal or code execution vulnerability accessible over the network (port 443) without authentication. An attacker can exploit this to achieve remote code execution with unrestricted privileges on the underlying OS hosting vCenter Server, affecting versions 7.x, 6.7, and 6.5 before specified patches.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · VMware Cloud Foundationn/a · VMware vCenter Server
public PoCs found — 62
exploitdbwww.exploit-db.com/exploits/49602unverifiedexploitdbwww.exploit-db.com/exploits/50056unverifiedgithubgithub.com/Schira4396/VcenterKiller★ 1483githubgithub.com/NS-Sp4ce/CVE-2021-21972★ 497githubgithub.com/horizon3ai/CVE-2021-21972★ 268githubgithub.com/psc4re/NSE-scripts★ 162githubgithub.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC★ 136githubgithub.com/alt3kx/CVE-2021-21972★ 52githubgithub.com/milo2012/CVE-2021-21972★ 33githubgithub.com/GuayoyoCyber/CVE-2021-21972★ 29githubgithub.com/conjojo/VMware_vCenter_UNAuthorized_RCE_CVE-2021-21972★ 28githubgithub.com/TaroballzChen/CVE-2021-21972★ 19githubgithub.com/B1anda0/CVE-2021-21972★ 11githubgithub.com/Ma1Dong/vcenter_rce★ 11githubgithub.com/orangmuda/CVE-2021-21972★ 11githubgithub.com/yaunsky/CVE-2021-21972★ 8githubgithub.com/murataydemir/CVE-2021-21972★ 6githubgithub.com/ByZain/CVE-2021-21972★ 3githubgithub.com/haidv35/CVE-2021-21972★ 3githubgithub.com/pettyhacks/vSphereyeeter★ 3githubgithub.com/renini/CVE-2021-21972★ 2githubgithub.com/L-pin/CVE-2021-21972★ 1githubgithub.com/robwillisinfo/VMware_vCenter_CVE-2021-21972★ 1githubgithub.com/Osyanina/westone-CVE-2021-21972-scanner★ 1githubgithub.com/TAI-REx/CVE-2021-21972★ 0githubgithub.com/user16-et/cve-2021-21972_PoC★ 0githubgithub.com/SimoesCTT/CTT-enhanced-VMware-vCenter★ 0githubgithub.com/Hurrrraaaa/CVE-2021-21972★ 0githubgithub.com/d3sh1n/cve-2021-21972★ 0githubgithub.com/JMousqueton/Detect-CVE-2021-21972★ 0vulncheckvulncheck.com/xdb/a7861044684bunverifiedvulncheckvulncheck.com/xdb/4cd8ec4552aeunverifiedvulncheckvulncheck.com/xdb/a94c832dd944unverifiedvulncheckvulncheck.com/xdb/dc0b46e20f6funverifiedvulncheckvulncheck.com/xdb/a59690df9cb5unverifiedvulncheckvulncheck.com/xdb/93708da6b80funverifiedvulncheckvulncheck.com/xdb/024d4588b4c7unverifiedvulncheckvulncheck.com/xdb/6b4434a13dfeunverifiedvulncheckvulncheck.com/xdb/b31ce24a2fd8unverifiedvulncheckvulncheck.com/xdb/0881bb35ce65unverifiedvulncheckvulncheck.com/xdb/087036e51a0aunverifiedvulncheckvulncheck.com/xdb/f10f8971b996unverifiedvulncheckvulncheck.com/xdb/e3cd0f2b9c4aunverifiedvulncheckvulncheck.com/xdb/bef16d85cf6bunverifiedvulncheckvulncheck.com/xdb/51d9db6c8498unverifiedvulncheckvulncheck.com/xdb/5a55e5206802unverifiedvulncheckvulncheck.com/xdb/4dc77b48cf47unverifiedvulncheckvulncheck.com/xdb/bf096845ad35unverifiedcve_referencepacketstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/fd2fcce15234unverifiedcve_referencepacketstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.htmlunverifiedvulncheckvulncheck.com/xdb/e4f7d23fc6bcunverifiedvulncheckvulncheck.com/xdb/faddcda29d3cunverifiedvulncheckvulncheck.com/xdb/88eb7edb230dunverifiedvulncheckvulncheck.com/xdb/3c3cce71135bunverifiedvulncheckvulncheck.com/xdb/e5087c9a9442unverifiedvulncheckvulncheck.com/xdb/f5085330e7bcunverifiedvulncheckvulncheck.com/xdb/ac0201ca4ddfunverifiedcve_referencepacketstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/f3659ae41b0aunverifiedvulncheckvulncheck.com/xdb/631d9af3bfb8unverifiedvulncheckvulncheck.com/xdb/2d286a01e9d1unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.