{ "file_item": { "filepath": "security-advisories", "filename": "CERT-EU-SA2021-052.pdf" }, "title": "UPDATE: Critical Vulnerabilities in VMware Products", "serial_number": "2021-052", "publish_date": "22-09-2021 12:59:00", "description": "On Tuesday, September 21, 2021, VMware has released VMSA-2021-0020 advisory to address multiple vulnerabilities in vCenter Server and Cloud Foundation appliances that a remote attacker could exploit to take control of an affected system. The most urgent and critical is a file upload vulnerability CVE-2021-22005 that can be used to execute commands and software on the vCenter Server Appliance.
On Tuesday, September 24, 2021 VMware updated the advisory VMSA-2021-0020.1 and confirmed reports that CVE-2021-22005 is being exploited in the wild. Security researchers are also reporting mass scanning for vulnerable vCenter Servers and publicly available exploit code.", "url_title": "2021-052", "content_markdown": "---\ntitle: 'Critical Vulnerabilities in\u00a0VMware\u00a0Products'\nversion: '1.1'\nnumber: '2021-052'\ndate: 'September 28, 2021'\n---\n\n_History:_\n\n* _22/09/2021 --- v1.0 -- Initial publication_\n* _28/09/2021 --- v1.1 -- Update with information about the active exploitation_\n\n# Summary\n\nOn Tuesday, September 21, 2021, VMware has released VMSA-2021-0020 advisory [1] to address multiple vulnerabilities in vCenter Server and Cloud Foundation appliances that a remote attacker could exploit to take control of an affected system. The most urgent and critical is a file upload vulnerability **CVE-2021-22005** that can be used to execute commands and software on the vCenter Server Appliance [2].\n\nOn Tuesday, September 24, 2021 VMware updated the advisory VMSA-2021-0020.1 and confirmed reports that **CVE-2021-22005 is being exploited** in the wild [1]. Security researchers are also reporting **mass scanning** for vulnerable vCenter Servers and publicly available exploit code [5, 6, 7].\n\n# Technical Details\n\nA malicious actor with network access to port 443 on vCenter Server may exploit **CVE-2021-22005 (CVSSv3 base score of 9.8)** vulnerability to execute code on vCenter Server by uploading a specially crafted file, **regardless of the configuration settings of vCenter Server** [1, 2].\n\n# Affected Products\n\nThe **CVE-2021-22005** vulnerability impacts following versions [4]:\n\n- VMware vCenter Server 6.7\n- VMware vCenter Server 7.0\n\nThis issue (CVE-2021-22005) does not affect vCenter Server 6.5 [1].\n\n# Recommendations\n\nVMware recommends affected customers to install relevant updates as soon as possible.\n\n## Workarounds\n\nVMware also provides a workaround for those who cannot immediately patch their appliances as a temporary solution [3].\n\n# References\n\n[1] \n\n[2] \n\n[3] \n\n[4] \n\n[5] \n\n[6] \n\n[7] \n", "content_html": "

History:

  • 22/09/2021 --- v1.0 -- Initial publication
  • 28/09/2021 --- v1.1 -- Update with information about the active exploitation

Summary

On Tuesday, September 21, 2021, VMware has released VMSA-2021-0020 advisory [1] to address multiple vulnerabilities in vCenter Server and Cloud Foundation appliances that a remote attacker could exploit to take control of an affected system. The most urgent and critical is a file upload vulnerability CVE-2021-22005 that can be used to execute commands and software on the vCenter Server Appliance [2].

On Tuesday, September 24, 2021 VMware updated the advisory VMSA-2021-0020.1 and confirmed reports that CVE-2021-22005 is being exploited in the wild [1]. Security researchers are also reporting mass scanning for vulnerable vCenter Servers and publicly available exploit code [5, 6, 7].

Technical Details

A malicious actor with network access to port 443 on vCenter Server may exploit CVE-2021-22005 (CVSSv3 base score of 9.8) vulnerability to execute code on vCenter Server by uploading a specially crafted file, regardless of the configuration settings of vCenter Server [1, 2].

Affected Products

The CVE-2021-22005 vulnerability impacts following versions [4]:

  • VMware vCenter Server 6.7
  • VMware vCenter Server 7.0

This issue (CVE-2021-22005) does not affect vCenter Server 6.5 [1].

Recommendations

VMware recommends affected customers to install relevant updates as soon as possible.

Workarounds

VMware also provides a workaround for those who cannot immediately patch their appliances as a temporary solution [3].

References

[1] https://www.vmware.com/security/advisories/VMSA-2021-0020.html

[2] https://blogs.vmware.com/vsphere/2021/09/vmsa-2021-0020-what-you-need-to-know.html

[3] https://kb.vmware.com/s/article/85717

[4] https://www.bleepingcomputer.com/news/security/vmware-warns-of-critical-bug-in-default-vcenter-server-installs/

[5] https://us-cert.cisa.gov/ncas/current-activity/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active

[6] https://twitter.com/bad_packets/status/1441465508348317702

[7] https://www.bleepingcomputer.com/news/security/hackers-exploiting-critical-vmware-vcenter-cve-2021-22005-bug/

", "licence": { "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)", "link": "https://creativecommons.org/licenses/by/4.0/", "restrictions": "https://cert.europa.eu/legal-notice", "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies" } }