CVE-2021-21972
CVE-2021-21972
Em resumo
Uma falha no VMware vCenter Server permite que invasores na rede executem comandos não autorizados com controle total do servidor. Esta é uma vulnerabilidade crítica que afeta várias versões do vCenter e Cloud Foundation.
Detalhe técnico
O plugin vSphere Client (HTML5) no vCenter Server contém uma vulnerabilidade de path traversal ou execução de código acessível remotamente na porta 443, geralmente sem autenticação prévia. Um atacante pode explorar isso para executar código remoto com privilégios irrestritos no sistema operacional que hospeda o vCenter Server, afetando versões 7.x, 6.7 e 6.5 antes dos patches especificados.
Resumo gerado e traduzido por IA a partir da descrição oficial.
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PoCs públicas encontradas — 32
githubgithub.com/Schira4396/VcenterKiller★ 1475githubgithub.com/NS-Sp4ce/CVE-2021-21972★ 501githubgithub.com/horizon3ai/CVE-2021-21972★ 269githubgithub.com/psc4re/NSE-scripts★ 162githubgithub.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC★ 137githubgithub.com/alt3kx/CVE-2021-21972★ 54githubgithub.com/milo2012/CVE-2021-21972★ 33githubgithub.com/GuayoyoCyber/CVE-2021-21972★ 28githubgithub.com/conjojo/VMware_vCenter_UNAuthorized_RCE_CVE-2021-21972★ 28githubgithub.com/TaroballzChen/CVE-2021-21972★ 20githubgithub.com/orangmuda/CVE-2021-21972★ 11githubgithub.com/B1anda0/CVE-2021-21972★ 11githubgithub.com/Ma1Dong/vcenter_rce★ 11githubgithub.com/yaunsky/CVE-2021-21972★ 8githubgithub.com/murataydemir/CVE-2021-21972★ 6githubgithub.com/ByZain/CVE-2021-21972★ 3githubgithub.com/haidv35/CVE-2021-21972★ 3githubgithub.com/pettyhacks/vSphereyeeter★ 3githubgithub.com/renini/CVE-2021-21972★ 2githubgithub.com/L-pin/CVE-2021-21972★ 1githubgithub.com/robwillisinfo/VMware_vCenter_CVE-2021-21972★ 1githubgithub.com/Osyanina/westone-CVE-2021-21972-scanner★ 1githubgithub.com/d3sh1n/cve-2021-21972★ 0githubgithub.com/user16-et/cve-2021-21972_PoC★ 0githubgithub.com/JMousqueton/Detect-CVE-2021-21972★ 0githubgithub.com/TAI-REx/CVE-2021-21972★ 0githubgithub.com/SimoesCTT/CTT-enhanced-VMware-vCenter★ 0exploitdbwww.exploit-db.com/exploits/49602não verificadocve_referencepacketstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.htmlnão verificadocve_referencepacketstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.htmlnão verificadoexploitdbwww.exploit-db.com/exploits/50056não verificadocve_referencepacketstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.htmlhttp://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21972https://www.vmware.com/security/advisories/VMSA-2021-0002.html