Hackers scan for VMware vCenter servers vulnerable to CVE-2021
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21985 | Remote Code Execution in VMware vCenter Server vSAN Health Check plug-in CVE-2021-21985 is an improper input validation flaw (CWE-20, with related unsafe reflection CWE-470 and SSRF CWE-918 classifications) in the Virtual SAN Health Check plug-in of the VMware vSphere Client, which is enabled by default in vCenter Server. It is triggered by crafted requests sent to the plug-in over the network; VMware indicated that network access to vCenter's HTTPS port (443) is sufficient to reach the vulnerable component. A successful attacker gains remote code execution with unrestricted privileges on the underlying operating system hosting vCenter Server, a highly privileged position in the virtualization stack. Any organization running an affected VMware vCenter Server is affected; because vCenter is the default management plane for vSphere, this spans a very large share of enterprise virtualization estates, with tens of thousands of instances directly exposed to the internet. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and requires applying vendor updates, and EPSS puts the 30-day exploitation probability at essentially 100%, though the source data lists no public PoC. Do: Update vCenter Server per VMware's instructions; fixes shipped in May 2021 for the 6.5, 6.7, and 7.0 branches (e.g., 6.5 U3n, 6.7 U3o, and 7.0 U2c — verify your current build against the vendor advisory). Until patched, restrict access to vCenter's HTTPS (443) interface to trusted management networks rather than the open internet, and review appliance logs and running processes for indicators of exploitation, since ransomware operators are known to use this flaw after gaining network access. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed vCenter servers (public scan data), with a total installed base likely in the hundreds of thousands |
Full article302 words · extracted from securityaffairs.com · click to collapse
Hackers are actively scanning the Internet for VMware vCenter servers vulnerable against a critical RCE flaw recently fixed by VMware.
Threat actors are actively scanning the Internet for VMware vCenter servers affected by a critical remote code execution (RCE) vulnerability tracked as CVE-2021-21985.
The CVE-2021-21985 flaw is caused by the lack of input validation in the Virtual SAN (vSAN) Health Check plug-in, which is enabled by default in the vCenter Server. The vulnerability has received a CVSS score of 9.8 and impacts vCenter Server 6.5, 6.7, and 7.0.
“The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server.” reads the advisory published by the virtualization giant. “A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.”
According to the virtualization giant, a remote attacker can exploit the issue to gain access to a vCenter installs exposed online, whether a customer uses vSAN or not.
The scanning activity was first reported by the threat intelligence firm Bad Packets.
https://twitter.com/bad_packets/status/1400519385194766336
The availability of a proof-of-concept (PoC) exploit code for the CVE-2021-21985 RCE make it easy for thereat actors to target vulnerable installs.
At the time of this writing, thousands of vulnerable vCenter servers are still exposed online.
VMware customers have to patch their systems immediately to prevent threat actors from exploiting vulnerabilities affecting the solutions of the virtualization giant.
Multiple ransomware gangs, including Darkside and RansomExx, exploited vulnerabilities in VMWare ESXi to encrypt virtual hard disks.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Epsilon Red ransomware)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/118594/hacking/hackers-vmware-vcenter-cve-2021-21985.html