CVE-2021-21972 (점검기)

VMware vCenter Server CVE-2021-21972 원격 코드 실행 취약점

이 스크립트는 다음 경로를 기반으로 CVE-2021-21972의 존재 여부를 확인합니다. "/ui/vropspluginui/rest/services/uploadova"에 POST 요청을 보내고 응답 본문(500)에서 "uploadFile"이라는 단어를 찾습니다. 이는 vCenter가 제한 없이 POST를 통해 파일을 수락할 수 있음을 의미합니다.

수동 확인:

# curl -i -s -k -X $'GET' -H $'Host: <target>' -H $'User-Agent: alex666' $'https://<target>/ui/vropspluginui/rest/services/getstatus'

# curl -i -s -k -X $'GET' -H $'Host: <target>' -H $'User-Agent: alex666'$'https://<target>/ui/vropspluginui/rest/services/uploadova'

# curl -i -s -k -X $'POST' -H $'Host: <target>' -H $'User-Agent: alex666' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 0' $'https://<target>/ui/vropspluginui/rest/services/uploadova'

참고 자료:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21972
https://www.vmware.com/security/advisories/VMSA-2021-0002.html

사용법

nmap -p443 --script CVE-2021-21972.nse <target>

출력

---
-- @usage
-- nmap -p443 --script CVE-2021-21972.nse <target>
-- @output
-- PORT    STATE SERVICE
-- 443/tcp open  https
-- | CVE-2021-21972: 
-- |   VULNERABLE:
-- |   vCenter 6.5-7.0 RCE
-- |     State: VULNERABLE (Exploitable)
-- |     IDs:  CVE:CVE-2021-21972
-- |       The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. 
-- |       A malicious actor with network access to port 443 may exploit this issue to execute commands with 
-- |       unrestricted privileges on the underlying operating system that hosts vCenter Server.
-- |     Disclosure date: 2021-02-23
-- |     References:
-- |_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21972

저자

Alex Hernandez aka (@_alt3kx_)