VMware has issued a critical security advisory for customers using vCenter Server 6.5,6.7 and 7.0 – warning customers that they need to do something about it ‘right now.’
The problem (CVE-2021-22005) is a Remote Code Execution vulnerability with a CVSS score of 9.8. A malicious user with access to network port 443 is able to upload a specially crafted file resulting in code being executed on the vCenter server. No login credentials are needed making this especially dangerous if the vCenter server is published to the internet. However, even for vCenter servers protected behind the network firewall, any user on the local network with access to connect to the server would be able to execute arbitrary code.
As VMware advise in their Q&A: In this era of ransomware it is safest to assume that an attacker is already inside your network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible.
VMSA-2021-0020 actually contains details for twenty vulnerabilities that are all addressed in the patches released from VMware – the High and Critical rated vulnerabilities included are:
- vCenter Server RCE file upload vulnerability (CVE-2021-22005) – CVSS 9.8
- vCenter Server local privilege escalation vulnerability (CVE-2021-21991) – CVSS 8.8
- vCenter Server reverse proxy bypass vulnerability (CVE-2021-22006) – CVSS 8.3
- vCenter server unauthenticated API endpoint vulnerability (CVE-2021-22011) – CVSS 8.1
- vCenter Server improper permission local privilege escalation vulnerabilities (CVE-2021-22015) – CVSS 8.1
- vCenter Server unauthenticated API information disclosure vulnerability (CVE-2021-22012) – CVSS 7.5
- vCenter Server file path traversal vulnerability (CVE-2021-22013) – CVSS 7.5
- vCenter Server reflected XSS vulnerability (CVE-2021-22016) – CVSS 7.5
- vCenter Server rhttpproxy bypass vulnerability (CVE-2021-22017) – CVSS 7.3
- vCenter Server authenticated code execution vulnerability (CVE-2021-22014) – CVSS 7.2
- vCenter Server file deletion vulnerability (CVE-2021-22018) – CVSS 6.5
- vCenter Server XML parsing denial-of-service vulnerability (CVE-2021-21992) – CVSS 6.5
Full details of each vulnerability and the affected versions of vCenter are included in the vendor’s security advisory.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)