CVE-2021-21985
Published: 26 May 2021
Summary
CVE-2021-21985 is a critical-severity SSRF (CWE-918) vulnerability in Vmware Vcenter Server. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and CM-7 (Least Functionality).
Deeper analysis
The vulnerability CVE-2021-21985 is a remote code execution flaw in the vSphere Client (HTML5) caused by insufficient input validation in the Virtual SAN Health Check plug-in. This component is enabled by default in vCenter Server, and the weakness is tracked under CWEs 918, 20, and 470 with a CVSS 3.1 score of 9.8.
An unauthenticated attacker with network access to TCP port 443 can send crafted requests that result in arbitrary command execution with unrestricted privileges on the operating system hosting vCenter Server.
Public advisories and exploit references for the issue have been published by VMware and archived on Packet Storm at the listed URLs. No additional details on patch availability, exploitation in the wild, or other context are provided in the source data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-9156
Vulnerability details
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443…
more
may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the Virtual SAN Health Check plug-in, blocking the crafted requests that enable unauthenticated RCE.
Restricts network traffic to TCP 443 on vCenter Server, limiting exposure of the vulnerable plug-in to only authorized management sources.
Enforces least functionality by disabling or removing the Virtual SAN Health Check plug-in when not required, eliminating the attack surface enabled by default.