VMware fixes critical vCenter Server RCE vulnerability, urges immediate action (CVE-2021-21985)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21985 +1 in the same advisory: …21986 | Remote Code Execution in VMware vCenter Server vSAN Health Check plug-in CVE-2021-21985 is an improper input validation flaw (CWE-20, with related unsafe reflection CWE-470 and SSRF CWE-918 classifications) in the Virtual SAN Health Check plug-in of the VMware vSphere Client, which is enabled by default in vCenter Server. It is triggered by crafted requests sent to the plug-in over the network; VMware indicated that network access to vCenter's HTTPS port (443) is sufficient to reach the vulnerable component. A successful attacker gains remote code execution with unrestricted privileges on the underlying operating system hosting vCenter Server, a highly privileged position in the virtualization stack. Any organization running an affected VMware vCenter Server is affected; because vCenter is the default management plane for vSphere, this spans a very large share of enterprise virtualization estates, with tens of thousands of instances directly exposed to the internet. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and requires applying vendor updates, and EPSS puts the 30-day exploitation probability at essentially 100%, though the source data lists no public PoC. Do: Update vCenter Server per VMware's instructions; fixes shipped in May 2021 for the 6.5, 6.7, and 7.0 branches (e.g., 6.5 U3n, 6.7 U3o, and 7.0 U2c — verify your current build against the vendor advisory). Until patched, restrict access to vCenter's HTTPS (443) interface to trusted management networks rather than the open internet, and review appliance logs and running processes for indicators of exploitation, since ransomware operators are known to use this flaw after gaining network access. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed vCenter servers (public scan data), with a total installed base likely in the hundreds of thousands |
Full article513 words · extracted from helpnetsecurity.com · click to collapse
VMware has patched two vulnerabilities (CVE-2021-21985, CVE-2021-21986) affecting VMware vCenter Server and VMware Cloud Foundation and is urging administrators to implement the offered security updates as soon as possible.
“All environments are different, have different tolerance for risk, and have different security controls and defense-in-depth to mitigate risk, so the decision on how to proceed is up to you. However, given the severity, we strongly recommend that you act,” the company noted.
About the vulnerabilities (CVE-2021-21985, CVE-2021-21986)
CVE-2021-21985 is a critical remote code execution vulnerability in the vSphere Client (HTML5). It exists due to lack of input validation in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server.
CVE-2021-21986 is a less severe vulnerability in a vSphere authentication mechanism for several plugins.
They affect vCenter Server 6.5, 6.7, and 7.0. and Cloud Foundation (vCenter Server) 3.x and 4.x.
Both vulnerabilities can be exploited by a malicious actors with network access to port 443. The first one would allow them to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server, while the second one may allow them to perform actions allowed by the impacted plug-ins – Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, VMware Cloud Director Availability – without authentication.
But as Claire Tills, Senior Research Engineer at Tenable, noted, even if an organization has not exposed vCenter Server externally, attackers can still exploit this flaw once inside a network.
Patching is strongly recommended
“In a rare move, VMware published a blog post calling out ransomware groups as being adept at leveraging flaws like this post-compromise, after having gained access to a network via other means such as spearphishing. With ransomware dominating the news, this context is important and reinforces VMware’s assertion that patching these flaws should be a top priority,” she told Help Net Security.
The blog post contains tips for patching, and the company has also published a Q&A document regarding the flaws and their remediation. While workarounds are available, VMware says that implementing the security updates is the better option.
According to Tills, there is currently no proof-of-concept code available for either CVE-2021-21985 and CVE-2021-21986. Nevertheless, she pointed out that in February 2020, VMware patched two other vCenter Server vulnerabilities and researchers saw mass scanning for the RCE one within a day of its publication.
UPDATE (June 5, 2021, 01:10 a.m. PT):
A working PoC for CVE-2021-21985 has been made public, and honeypots are detecting attackers scanning for and exploiting the bug.
UPDATE (June 15, 2021, 11:50 p.m. PT):
Trustwave SpiderLabs researchers have used the Shodan search engine to discover how many still vulnerable VMWare vCenter Server instances are currently connected to the internet.
“Out of 4969 data [related to internet-facing vCenter Server instances] downloaded from Shodan, 4019 (80.88%) are vulnerable,” security researcher Jason Villaluna shared. Of the remaining 950 (19.12%) hosts, the overwhelming majority uses old, “end of life” versions, meaning that these are not likely to have been patched since they are unsupported, he added.
Also, there are now more public PoC exploits for CVE-2021-21985.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/05/26/cve-2021-21985/