cve-2021-22005-exp

0x01 Vulnerability Overview

On September 21, 2021, VMware released a security advisory disclosing 19 security vulnerabilities in vCenter Server, with CVSSv3 scores ranging from 4.3 to 9.8.

Among them, the most critical vulnerability is an arbitrary file upload vulnerability in vCenter Server (CVE-2021-22005), which exists in the analysis service of vCenter Server, with a CVSSv3 score of 9.8. An attacker with network access to port 443 on vCenter Server can remotely execute code by uploading malicious files. This vulnerability can be exploited remotely without authentication, has low attack complexity, and requires no user interaction.

0x02 Affected Versions

• vCenter Server 7.0 < 7.0 U2c build-18356314
• vCenter Server 6.7 < 6.7 U3o build-18485166
• Cloud Foundation (vCenter Server) 4.x < KB85718 (4.3)
• Cloud Foundation (vCenter Server) 3.x < KB85719 (3.10.2.2)

6.7 vCenters Windows version is not affected

0x03 Vulnerability Analysis

https://xz.aliyun.com/t/10524

https://testbnull.medium.com/quick-note-of-vcenter-rce-cve-2021-22005-4337d5a817ee

0x04 Usage Instructions

Note: This exploit only works against vCenter running on Linux.

Help

usage: exp [-h] -t TARGET [-s SHELL] [-p PROXY]

optional arguments:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        target url(e.g. https://192.168.1.1)
  -s SHELL, --shell SHELL
                        local webshell file path(default cmd.jsp)
  -p PROXY, --proxy PROXY
                        request proxy(e.g. http://127.0.0.1:1080)

This exploit has been tested against VMware vCenter Server 7.0.0 build-16323968.