sknux/cve-2021-21985_pocVMWARE VCENTER SERVER VIRTUAL SAN HEALTH CHECK PLUG-IN RCE (CVE-2021-21985)
Il client vSphere (HTML5) contiene una vulnerabilità di esecuzione remota di codice in un plugin di vCenter Server. Un attore malintenzionato con accesso di rete alla porta 443 può sfruttare questo problema per eseguire comandi con privilegi illimitati sul sistema operativo sottostante che ospita vCenter Server. Ciò riguarda VMware vCenter Server (7.x precedenti a 7.0 U2b, 6.7 precedenti a 6.7 U3n e 6.5 precedenti a 6.5 U3p) e VMware Cloud Foundation (4.x precedenti a 4.2.1 e 3.x precedenti a 3.10.2.1).
> git clone https://github.com/sknux/CVE-2021-21985_PoC
> cd CVE-2021-21985_PoC
> chmod +x cve-2021-21985_PoC
> ./cve-2021-21985_PoC
$ Usage: ./poc Target-IP Class/Method(s). To list all class/methods, please use -l option.
> ./cve-2021-21985_PoC -l
$ getClusterCapabilityData
getHostCapabilityData
getHostsCapabilitiyData
getIsDeduplicationSupported
getIsEncryptionSupported
getIsLocalDataProtectionSupportedOnVc
getIsLocalDataProtectionSupportedOnCluster
getIsRemoteDataProtectionSupported
getIsObjectIdentitiesSupportedOnCluster
getIsHistoricalCapacitySupported
getIsPerfVerboseModeSupported
getIsPerfNetworkDiagnosticModeSupported
getIsPerfDiagnosticsFeedbackSupportedOnVc
getIsAdvancedClusterSettingsSupported
getIsRecreateDiskGroupSupported
getIsPurgeInaccessibleVmSwapObjectsSupported
getIsUpdateVumReleaseCatalogOfflineSupported
getIsVitOnlineResizeSupported
getIsImprovedCapacityMonitoringSupportedOnVc
getIsVmLevelCapacityMonitoringSupported
getIsWhatIfCapacitySupported
getIsHostReservedCapacitySupported
getIsUnmountWithMaintenanceModeSupported
getIsEvacuationStatusSupportedOnCluster
...
...