2 ms·

Code-execution flaw in VMware has a severity rating of 9.8 out of 10

3 points by nobody9999 6y ago

nobody9999 6y ago
The vulnerability is CVE-2021-21974[0] and has been acknowledged by VMWare with their own advisory[1] and affects ESXi, VCenter Server and VMWare Cloud Foundation. Apparently, the RCE exploit requires no authorization to upload files to exposed servers. According to the submission link: "CVE-2021-21972 allows hacker with no authorization to upload files to vulnerable vCenter servers that are publicly accessible over port 443, researchers from security firm Tenable said. Successful exploits will result in hackers gaining unfettered remote code-execution privileges in the underlying operating system. The vulnerability stems from a lack of authentication in the vRealize Operations plugin, which is installed by default." There have been multiple proof-of-concept exploits[2] published and thousands of systems[3] appear to currently be under attack. What I want to know is why anyone would expose their VMWare management interface to the Internet? [0] https://nvd.nist.gov/vuln/detail/CVE-2021-21974 https://nvd.nist.gov/vuln/detail/CVE-2021-21974 [1] https://www.vmware.com/security/advisories/VMSA-2021-0002.html https://www.vmware.com/security/advisories/VMSA-2021-0002.ht... [2] https://gist.github.com/milo2012/9ba4ac8bb0dfa59497d02b27d820eeb5 https://gist.github.com/milo2012/9ba4ac8bb0dfa59497d02b27d82... [3] https://nitter.mastodont.cat/bad_packets/status/1364672466707128320 https://nitter.mastodont.cat/bad_packets/status/136467246670...