sknux/cve-2021-21985_pocVMWARE VCENTER SERVER VIRTUAL SAN HEALTH CHECK PLUG-IN RCE (CVE-2021-21985)
El vSphere Client (HTML5) contiene una vulnerabilidad de ejecución remota de código en un plugin de vCenter Server. Un actor malicioso con acceso a la red al puerto 443 podría explotar este problema para ejecutar comandos con privilegios sin restricciones en el sistema operativo subyacente que aloja vCenter Server. Esto afecta a VMware vCenter Server (7.x anteriores a 7.0 U2b, 6.7 anteriores a 6.7 U3n y 6.5 anteriores a 6.5 U3p) y VMware Cloud Foundation (4.x anteriores a 4.2.1 y 3.x anteriores a 3.10.2.1).
> git clone https://github.com/sknux/CVE-2021-21985_PoC
> cd CVE-2021-21985_PoC
> chmod +x cve-2021-21985_PoC
> ./cve-2021-21985_PoC
$ Usage: ./poc Target-IP Class/Method(s). To list all class/methods, please use -l option.
> ./cve-2021-21985_PoC -l
$ getClusterCapabilityData
getHostCapabilityData
getHostsCapabilitiyData
getIsDeduplicationSupported
getIsEncryptionSupported
getIsLocalDataProtectionSupportedOnVc
getIsLocalDataProtectionSupportedOnCluster
getIsRemoteDataProtectionSupported
getIsObjectIdentitiesSupportedOnCluster
getIsHistoricalCapacitySupported
getIsPerfVerboseModeSupported
getIsPerfNetworkDiagnosticModeSupported
getIsPerfDiagnosticsFeedbackSupportedOnVc
getIsAdvancedClusterSettingsSupported
getIsRecreateDiskGroupSupported
getIsPurgeInaccessibleVmSwapObjectsSupported
getIsUpdateVumReleaseCatalogOfflineSupported
getIsVitOnlineResizeSupported
getIsImprovedCapacityMonitoringSupportedOnVc
getIsVmLevelCapacityMonitoringSupported
getIsWhatIfCapacitySupported
getIsHostReservedCapacitySupported
getIsUnmountWithMaintenanceModeSupported
getIsEvacuationStatusSupportedOnCluster
...
...