Rewterz Threat Advisory – Multiple VMware vCenter Vulnerabilities

Severity

High

Analysis Summary

CVE-2021-22005 

A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

CVE-2021-21991

A malicious actor with non-administrative user access on vCenter Server host may exploit this issue to escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).

CVE-2021-22006

A malicious actor with network access to port 443 on vCenter Server may exploit this issue to access restricted endpoints.

CVE-2021-22011

A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation.

CVE-2021-22015

An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.

CVE-2021-22012

A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

CVE-2021-22013

A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

CVE-2021-22016

An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link.

CVE-2021-22017

A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.   

CVE-2021-22014

An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server.

CVE-2021-22018

A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files.

CVE-2021-21992

A malicious actor with non-administrative user access to the vCenter Server vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash) may exploit this issue to create a denial-of-service condition on the vCenter Server host.

CVE-2021-22007

An authenticated user with non-administrative privilege may exploit this issue to gain access to sensitive information.

CVE-2021-22019

A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition.

CVE-2021-22009

A malicious actor with network access to port 443 on vCenter Server may exploit these issues to create a denial of service condition due to excessive memory consumption by VAPI service.

CVE-2021-22010

A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consumption by VPXD service.

CVE-2021-22008

A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to gain access to sensitive information.

CVE-2021-22020

Successful exploitation of this issue may allow an attacker to create a denial-of-service condition on vCenter Server.

CVE-2021-21993

An authorised user with access to content library may exploit this issue by sending a POST request to vCenter Server leading to information disclosure.

Impact

• Code Execution
• Privilege Escalation
• Information Disclosure
• Cross-site Scripting
• Denial of Service

Affected Vendors

• VMwarE

Affected Products

• VMware vCenter Server (vCenter Server)
• VMware Cloud Foundation (Cloud Foundation)

Remediation

Refer to VMware Security Advisory for patch, upgrade, or suggested workaround information.