VMware warns of critical bug in default vCenter Server installs

guest · Sep 22, 2021

VMware warns of critical bug in default vCenter Server installs
September 21, 2021
https://www.bleepingcomputer.com/ne...tical-bug-in-default-vcenter-server-installs/

VMware warns customers to immediately patch a critical arbitrary file upload vulnerability in the Analytics service, impacting all appliances running default vCenter Server 6.7 and 7.0 deployments.

vCenter Server is a server management solution that helps IT admins manage virtualized hosts and virtual machines in enterprise environments via a single console.

"This vulnerability can be used by anyone who can reach vCenter Server over the network to gain access, regardless of the configuration settings of vCenter Server," said Bob Plankers, Technical Marketing Architect at VMware.
Click to expand...

Critical bug with an almost perfect severity score
The security flaw — tracked as CVE-2021-22005 and with a CVSS 3.1 severity rating of 9.8/10 — can be exploited by attackers to execute commands and software on unpatched vCenter Server deployments by uploading a specially crafted file.

"The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service," VMware explains in the security advisory. "A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file."
"Immediately, the ramifications of this vulnerability are serious and it is a matter of time – likely minutes after the disclosure – before working exploits are publicly available," VMware said.
Click to expand...

guest · Sep 22, 2021

Hackers are scanning for VMware CVE-2021-22005 targets, patch now!
September 22, 2021
https://www.bleepingcomputer.com/ne...-for-vmware-cve-2021-22005-targets-patch-now/

Threat actors have already started targeting Internet-exposed VMware vCenter servers unpatched against a critical arbitrary file upload vulnerability patched yesterday that could lead to remote code execution.
The security flaw tracked as CVE-2021-22005 impacts all vCenter Server 6.7 and 7.0 deployments with default configurations.

While exploit code is not yet publicly available, ongoing scanning activity was already spotted by threat intelligence company Bad Packets 12 hours ago after some of its VMware honeypots began recording attackers probing for the presence of the critical bug.

"CVE-2021-22005 scanning activity detected from 116[.]48.233.234," Bad Packets tweeted earlier today, later adding that the scans are using workaround information provided by VMware for customers who couldn't immediately patch their appliances.
Click to expand...

Right now, thousands of potentially vulnerable vCenter servers are reachable over the Internet and exposed to attacks, according to the Shodan search engine for Internet-connected devices.
Click to expand...

guest · Sep 24, 2021

Exploits imminent for critical VMware vCenter CVE-2021-22005 bug
September 24, 2021
https://www.bleepingcomputer.com/ne...r-critical-vmware-vcenter-cve-2021-22005-bug/

Exploit code that could be used to achieve remote code execution on VMware vCenter Server vulnerable to CVE-2021-22005 is currently spreading online.

Publicly disclosed earlier this week when VMware also addressed it, the bug comes with a critical severity rating of 9.8 and a strong recommendation to install the available patch.
Click to expand...

Earlier today, Vietnamese security researcher Jang published technical notes for CVE-2021-22005 based on the workaround and the patch from VMware.
The details are enough for experienced developers to create a working exploit that allows remote code execution with root privileges, the researcher told BleepingComputer.

At the end of the post, Jang also provides a GitHub link to his PoC version for CVE-2021-22005. It is not a fully functional variant, though, intentionally so to prevent less skilled threat actors from using it in attacks directly.
Click to expand...

Penetration tester and Synack Envoy Nicolas Krassas tested the code and confirmed that it needs some modifications to work properly. But it does prove that CVE-2021-22005 can be used to create a backdoor on a vulnerable system.
Click to expand...

guest · Sep 24, 2021

VMware vCenter Server Vulnerability CVE-2021-22005 Under Active Exploit
September 24, 2021
https://us-cert.cisa.gov/ncas/curre...ver-vulnerability-cve-2021-22005-under-active

On September 21, 2021, VMware disclosed that its vCenter Server is affected by an arbitrary file upload vulnerability—CVE-2021-22005—in the Analytics service. A malicious cyber actor with network access to port 443 can exploit this vulnerability to execute code on vCenter Server.

On September 24, 2021, VMware confirmed reports that CVE-2021-22005 is being exploited in the wild. Security researchers are also reporting mass scanning for vulnerable vCenter Servers and publicly available exploit code. Due to the availability of exploit code, CISA expects widespread exploitation of this vulnerability.
Click to expand...

To mitigate CVE-2021-22005, CISA strongly urges critical infrastructure entities and other organizations with affected vCenter Server versions to take the following actions.

Upgrade to a fixed version as quickly as possible. See VMware Security Advisory VMSA-2021-0020 for patching information.

Apply the temporary workaround provided by VMware, if unable to upgrade to a fixed version immediately. See VMware’s workaround instructions for CVE-2021-22005, supplemental blog post, and frequently asked questions for additional information.

Click to expand...

Log in or Sign up

VMware warns of critical bug in default vCenter Server installs

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

VMware warns of critical bug in default vCenter Server installs

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches