Clippy of the Dead - CVE-2021-21980 testing environment and Nuclei template

This repository contains a high-confidence Nuclei template to detect CVE-2021-21980 (vSphere Web Client path traversal) and a small mock environment that reproduces the vulnerable behavior for safe local testing.

Files:

• cve-2021-21980.yaml: Nuclei template with multiple encoding variants and matchers
• app.py: A small Flask app simulating /eam/vib path traversal vulnerability
• Dockerfile: Container image for the mock server with a self-signed TLS cert
• docker-compose.yml: Runs the mock server listening on host 8443
• requirements.txt: Python dependencies

Disclaimer

• This repository is for research, testing and defensive purposes only. Do not use against any system you are not authorized to scan.
• This mock server is not VMware vCenter; it only simulates the vulnerable behavior for safe PoC/testing.

How to run locally (Windows PowerShell example)

1. Build and run the mock container:

cd C:\Users\gui\Documents\hi
docker-compose up --build -d

The mock server will listen on https://localhost:8443 (self-signed TLS certificate).

2. Quick curl check (insecure flag because self-signed cert):

curl -k "https://localhost:8443/"  # should return VMware vSphere Web Client (mock)
curl -k "https://localhost:8443/eam/vib?id=../../../../../../../../../../etc/passwd"

You should receive the content of the mock /app/sensitive/passwd-mock file.

3. Run Nuclei (install Nuclei first) to validate the template against the mock server:

nuclei -t cve-2021-21980.yaml -u https://localhost:8443 -insecure

4. Output should show a match for the PoC if successful.

Testing notes

• If you want to test many encoding variants, set the Nuclei template to run with high verbosity.

• This mock server returns the mock file which replicates /etc/passwd; in a real environment Automated test script

  Run run_local_test.ps1 which builds, waits for readiness and executes the curl checks, plus Nuclei if available.

  root@kitploit:~

  powershell -ExecutionPolicy Bypass -File .\run_local_test.ps1
  

  Install Nuclei on Windows (quick):

  1. Using Scoop (recommended):
  root@kitploit:~

  iwr -useb get.scoop.sh | iex
  scoop install coreutils
  scoop install nuclei
  

  2. Or download from releases and add to PATH:
  root@kitploit:~

  Invoke-WebRequest -Uri https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_windows_amd64.zip -OutFile nuclei.zip
  Expand-Archive -Path nuclei.zip -DestinationPath .\nuclei
  Add-Content -Path $PROFILE -Value 'set PATH=$Env:PATH;$(Resolve-Path .\nuclei)'
  

  Notes

  If nuclei is not in PATH the will execute up to the curl tests only. If you get issue building docker image ensure Docker Desktop is installed and the 'Use the WSL 2 based engine' is enabled. /etc/passwd or similar file will be returned if the server is vulnerable.

Security: Always have explicit authorization before scanning or exploiting systems.