CVE-2021-21972
CVE-2021-21972
En resumen
Una falla en VMware vCenter Server permite que atacantes en la red ejecuten comandos no autorizados con control total del servidor. Esta es una vulnerabilidad crítica que afecta múltiples versiones de vCenter y Cloud Foundation.
Detalle técnico
El plugin vSphere Client (HTML5) en vCenter Server contiene una vulnerabilidad de path traversal o ejecución de código accesible remotamente en el puerto 443, típicamente sin autenticación requerida. Un atacante puede explotar esto para lograr ejecución remota de código con privilegios sin restricciones en el sistema operativo que aloja vCenter Server, afectando versiones 7.x, 6.7 y 6.5 antes de los parches especificados.
Resumen generado y traducido por IA a partir de la descripción oficial.
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PoCs públicas encontradas — 32
githubgithub.com/Schira4396/VcenterKiller★ 1475githubgithub.com/NS-Sp4ce/CVE-2021-21972★ 501githubgithub.com/horizon3ai/CVE-2021-21972★ 269githubgithub.com/psc4re/NSE-scripts★ 162githubgithub.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC★ 137githubgithub.com/alt3kx/CVE-2021-21972★ 54githubgithub.com/milo2012/CVE-2021-21972★ 33githubgithub.com/GuayoyoCyber/CVE-2021-21972★ 28githubgithub.com/conjojo/VMware_vCenter_UNAuthorized_RCE_CVE-2021-21972★ 28githubgithub.com/TaroballzChen/CVE-2021-21972★ 20githubgithub.com/orangmuda/CVE-2021-21972★ 11githubgithub.com/B1anda0/CVE-2021-21972★ 11githubgithub.com/Ma1Dong/vcenter_rce★ 11githubgithub.com/yaunsky/CVE-2021-21972★ 8githubgithub.com/murataydemir/CVE-2021-21972★ 6githubgithub.com/ByZain/CVE-2021-21972★ 3githubgithub.com/haidv35/CVE-2021-21972★ 3githubgithub.com/pettyhacks/vSphereyeeter★ 3githubgithub.com/renini/CVE-2021-21972★ 2githubgithub.com/L-pin/CVE-2021-21972★ 1githubgithub.com/robwillisinfo/VMware_vCenter_CVE-2021-21972★ 1githubgithub.com/Osyanina/westone-CVE-2021-21972-scanner★ 1githubgithub.com/d3sh1n/cve-2021-21972★ 0githubgithub.com/user16-et/cve-2021-21972_PoC★ 0githubgithub.com/JMousqueton/Detect-CVE-2021-21972★ 0githubgithub.com/TAI-REx/CVE-2021-21972★ 0githubgithub.com/SimoesCTT/CTT-enhanced-VMware-vCenter★ 0exploitdbwww.exploit-db.com/exploits/49602no verificadocve_referencepacketstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.htmlno verificadocve_referencepacketstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.htmlno verificadoexploitdbwww.exploit-db.com/exploits/50056no verificadocve_referencepacketstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.htmlhttp://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21972https://www.vmware.com/security/advisories/VMSA-2021-0002.html