Vulnérabilité d'exécution de code à distance dans VMware vCenter Server (CVE-2021-21972)
Ce script vérifie l'existence de CVE-2021-21972 en se basant sur le chemin suivant : "/ui/vropspluginui/rest/services/uploadova" via une requête POST et en recherchant dans le corps de la réponse (500) les mots "uploadFile", ce qui signifie que le vCenter est disponible pour accepter des fichiers via POST sans aucune restriction.
Inspection manuelle :
# curl -i -s -k -X $'GET' -H $'Host: <target>' -H $'User-Agent: alex666' $'https://<target>/ui/vropspluginui/rest/services/getstatus'
# curl -i -s -k -X $'GET' -H $'Host: <target>' -H $'User-Agent: alex666'$'https://<target>/ui/vropspluginui/rest/services/uploadova'
# curl -i -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 0' $'https://<target>/ui/vropspluginui/rest/services/uploadova'
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21972
https://www.vmware.com/security/advisories/VMSA-2021-0002.html
nmap -p443 --script CVE-2021-21972.nse <target>
---
-- @usage
-- nmap -p443 --script CVE-2021-21972.nse <target>
-- @output
-- PORT STATE SERVICE
-- 443/tcp open https
-- | CVE-2021-21972:
-- | VULNERABLE:
-- | vCenter 6.5-7.0 RCE
-- | State: VULNERABLE (Exploitable)
-- | IDs: CVE:CVE-2021-21972
-- | The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin.
-- | A malicious actor with network access to port 443 may exploit this issue to execute commands with
-- | unrestricted privileges on the underlying operating system that hosts vCenter Server.
-- | Disclosure date: 2021-02-23
-- | References:
-- |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21972
Alex Hernandez aka (@_alt3kx_)