02-23-2021 , 11:18 PM
VMware has addressed a critical remote code execution (RCE) vulnerability in the vCenter Server virtual infrastructure management platform that may allow attackers to potentially take control of affected systems.
vCenter Server helps IT admins manage virtualized hosts and virtual machines within enterprise environments via a single console.
Critical RCE scoring almost a perfect severity score
The privately reported vulnerability is tracked as CVE-2021-21972 and it was rated with a CVSSv3 base score of 9.8 out 10 according to VMware's security advisory.
CVE-2021-21972 was reported by Mikhail Klyuchnikov of Positive Technologies and it can be exploited remotely by unauthenticated attackers in low complexity attacks that don't require user interaction.
This security issue affects the VMware Directory Service (vmdir) only on upgraded installations and it's due to incorrectly implemented access controls.
"The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin," VMware explains in the advisory.
"A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server."
The impacted vCenter Server plugin for vRealize Operations (vROps) is present in all default installations, with vROPs not being required for the affected endpoint to be available.
VMware fixed an Unauth RCE in vCenter (CVE-2021-21972) found by our researcher Mikhail Klyuchnikov.
CVSS: 9.8
Advisory: https://t.co/8ylVdvcUqr pic.twitter.com/9g1gPboaap
— PT SWARM (@ptswarm) February 23, 2021
Workaround available
Due to this security vulnerability's critical nature, it is strongly recommended to upgrade vulnerable vCenter Server installations as soon as possible.
To patch the vulnerability, you have to upgrade affected installations to vCenter Server 6.5 U3n, 6.7 U3l, or 7.0 U1c.
For those who cannot immediately update to a version that patches the CVE-2021-21972 security flaw, VMware also provides a workaround that removes the possibility of exploitation.
Detailed steps on how to implement the workaround on Linux-based virtual appliances (vCSA) can be found in VMware's KB82374 support document.
VMware also fixed today an important heap-overflow vulnerability (tracked as CVE-2021-21974) in VMware ESXi that may enable attackers to execute arbitrary code remotely on impacted devices.
In April 2020, VMware addressed another critical vCenter Server vulnerability that could've allowed attackers to gain access to sensitive information and potentially take control of impacted Windows systems or virtual appliances.
Source
vCenter Server helps IT admins manage virtualized hosts and virtual machines within enterprise environments via a single console.
Critical RCE scoring almost a perfect severity score
The privately reported vulnerability is tracked as CVE-2021-21972 and it was rated with a CVSSv3 base score of 9.8 out 10 according to VMware's security advisory.
CVE-2021-21972 was reported by Mikhail Klyuchnikov of Positive Technologies and it can be exploited remotely by unauthenticated attackers in low complexity attacks that don't require user interaction.
This security issue affects the VMware Directory Service (vmdir) only on upgraded installations and it's due to incorrectly implemented access controls.
"The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin," VMware explains in the advisory.
"A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server."
The impacted vCenter Server plugin for vRealize Operations (vROps) is present in all default installations, with vROPs not being required for the affected endpoint to be available.
VMware fixed an Unauth RCE in vCenter (CVE-2021-21972) found by our researcher Mikhail Klyuchnikov.
CVSS: 9.8
Advisory: https://t.co/8ylVdvcUqr pic.twitter.com/9g1gPboaap
— PT SWARM (@ptswarm) February 23, 2021
Workaround available
Due to this security vulnerability's critical nature, it is strongly recommended to upgrade vulnerable vCenter Server installations as soon as possible.
To patch the vulnerability, you have to upgrade affected installations to vCenter Server 6.5 U3n, 6.7 U3l, or 7.0 U1c.
For those who cannot immediately update to a version that patches the CVE-2021-21972 security flaw, VMware also provides a workaround that removes the possibility of exploitation.
Detailed steps on how to implement the workaround on Linux-based virtual appliances (vCSA) can be found in VMware's KB82374 support document.
VMware also fixed today an important heap-overflow vulnerability (tracked as CVE-2021-21974) in VMware ESXi that may enable attackers to execute arbitrary code remotely on impacted devices.
In April 2020, VMware addressed another critical vCenter Server vulnerability that could've allowed attackers to gain access to sensitive information and potentially take control of impacted Windows systems or virtual appliances.
Source