VMware vSphere Client Unauth Remote Code Execution Vulnerability — CVE-2021-21972

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Recent assessments:

ccondon-r7 at February 24, 2021 11:19pm UTC reported:

Update March 3: Exploitation in the wild was confirmed over the weekend. See the Rapid7 analysis for more updates.

There are reports of opportunistic scanning for vulnerable vCenter Server endpoints and a bunch of PoC that’s made its way to GitHub over the past twelve hours or so. There hasn’t been confirmation of in-the-wild exploitation yet, but it’s hard to imagine that lasting for very long given the enterprise-grade incentives for attackers. As @wvu-r7 points out in the Rapid7 analysis, the update available for folks on vulnerable versions of vCenter Server merely adds authentication, addressing the attack chain rather than resolving the root cause of the vulnerability; I’d be a little surprised if we didn’t see a follow-on CVE at some point for an authentication bypass.

wvu-r7 at February 24, 2021 10:11pm UTC reported:

Update March 3: Exploitation in the wild was confirmed over the weekend. See the Rapid7 analysis for more updates.

There are reports of opportunistic scanning for vulnerable vCenter Server endpoints and a bunch of PoC that’s made its way to GitHub over the past twelve hours or so. There hasn’t been confirmation of in-the-wild exploitation yet, but it’s hard to imagine that lasting for very long given the enterprise-grade incentives for attackers. As @wvu-r7 points out in the Rapid7 analysis, the update available for folks on vulnerable versions of vCenter Server merely adds authentication, addressing the attack chain rather than resolving the root cause of the vulnerability; I’d be a little surprised if we didn’t see a follow-on CVE at some point for an authentication bypass.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5