25 ms·
Not a drill: VMware vuln with 9.8 severity rating is under attack
- ssakamoto 5y agoWebsite in tweet appears to be filled with suspicious malware like contents, beware
- hgo 5y agoDear arstechnica, please don't write articles like this, where you make it seem like curl is somehow related or even the cause: "It can be reproduced using five requests from cURL, a command-line tool that transfers data using HTTP, HTTPS, IMAP, and other common Internet protocols." I find it quite untasteful to somehow sneak an plug for curl in here at all. Thinking of: “I will slaughter you”, where Daniel explains how he gets death threats from clueless sysadmins that see that they have been hacked by someone that used curl. https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/ https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/ Edit: I have e-mailed the author, but someone that use Twitter may want to try and reach the author on @dangoodin001. Thank you.
- ComodoHacker 5y agoI can't see how it's a "sneak an plug" here. It's just a constatation of how easily exploitable the flaw is, using common tools like cURL. If an insecure website can be hacked using only dev tools in the browser, does anyone blame browser vendor?
- hgo 5y agoI guess you're right, but in this context it's clear by curl's author's blog post mentioned in my original post, that cause can be easily confused by less technically savy readers.
- xwolfi 5y agoYou mean absolute morons ? I'm sorry but your little war against ars technica will have to wait for an actual problem: saying you can exploit a vulnerability with cURL has really nothing to do with cURL... I mean who in the world woud think "oh then I need to delete cURL"? Sorry but your disdain for "less technical readers" is frankly insulting.
- detaro 5y agoYou consider people sending death threats to developers because they think curl is some evil hacking tool not an "actual problem", despite it already having happened? We sadly share the world with "absolute morons", yes. (also, how is asking for a change a "war" against the publication?)
- humanproxy 5y agoI am utterly stunned by the threat which Daniel Stenberg reports on his blog, the link above, frightened actually because before I got very far trying to think of ways to register for a icloud address as a throwaway email account, I realised that the threat was accompanied by no less than screen shots presumably from the same person's phone and if those are from a iPhone I'm pretty sure that the metadata in those images could verify if that's a real active and device and network subscription linked icloud account. The being HN I expect we automatically presume that everything is spoofed. Unfortunately having received death threats signed by the person's full name and someone identifiable in the media no less, I have to give it the possibility that that is the real person's name and icloud account identity and they simply don't care about anonymity because of having a completely dysfunctional mental condition. That's why this scared me. I'm becoming more and more aware of this kind of recklessness combined with the spectre of violence. Today in London in broad daylight a woman stabbed her victim amid a busy intersection crossing and carried on shouting at the victim "yeah I &ing stabbed you " over and over. Senses of proportion are long missing from broad society and I have started to think that like neurodegenerative diseases by the time we can't cover them up were done for. Edit : the reason I'm thinking about neurodegenerative diseases I think is because our understanding of social behaviour is rooted in a very brief attention to studying the world when there were simply very many fewer humans around in any way at liberty to act on their individual volition. The scale of our race in the present day I believe already requires a complete re-evaluation of models of civil order.
- TheAdamAndChe 5y agoNothing about the article implies cURL is responsible for the exploit, only that it can be used to leverage the exploit. It's relevant and good to know, and shouldn't be removed IMO.
- nkrisc 5y agoIt's strange to mention cURL specifically in this context. If the exploit only takes 5 HTTP requests, why not just say "5 HTTP requests"? Why does the article need to mention cURL at all if it's not relevant how those requests are sent? Unless cURL is relevant, but that's now how the article is written. If they're trying to get across to a non-technical audience how easy it is, then why mention cURL? They're not going to know what cURL is, as evidenced by the explainer following immediately. Why not just say, "5 HTTP requests sent by the command line"?
- TheAdamAndChe 5y agoHTTP exploit requests can be pretty complicated, and the use of cURL hints that it's a dirt simple exploit to leverage. This is an arstechnica article, their target demographic is more technically literate than the lowest common denominator.
- oasisbob 5y ago> HTTP exploit requests can be pretty complicated, and the use of cURL hints that it's a dirt simple exploit to leverage. Why would that be? Curl can perform incredibly complicated requests to the point where they're barely legible on the command line.
- nkrisc 5y agoRight, I understand. My point is that if they're going to mention cURL, but then describe it as "a command-line tool that transfers data using HTTP, HTTPS, IMAP, and other common Internet protocols." why not just say the attack can be executed directly from the command line? Any techincally literate audience will understand that implies cURL (or any other tool!) and an non-technical audience will understand its simplicity, if that is in fact the case. I still think it's strange to mention cURL specifically in the way they did and agree with the GP. Here's another terrible analogy for the HN archives, but it's kind of like saying, "the smash-and-grab on the jewel store can committed with a Stanley™ 16 oz Curved Claw Fiberglass Hammer" when of course any heavy, handheld object will do.
- ad404b8a372f2b9 5y agocURL is used for this purpose all the time, it's perfectly legitimate to mention it in this context, it's only factual. If you have to censor your content to account for the stupid and the mentally ill (slaughter guy sounds schizophrenic complete with delusions of grandeur and persecution syndrome), you will have to stop posting completely. What I find very distasteful is your attempt to incite people to harass the author over social media.
- lallysingh 5y agoThey should've at least mentioned that cURL is reputable. Like a "standard" tool. They can cut "common" out of that description with no loss.
- tinus_hn 5y agoI don’t think it is proper to try to mobilize people to harass a Twitter account.
- SyzygistSix 5y agoI feel like referring to the person who sent Daniel those emails a sysadmin is rather generous.
- terminalserver 5y ago9.8 out of 10? What’s the .2 represent?
- formerly_proven 5y agoNo access to nuke launch codes
- tyingq 5y agoThere's a calculator like thingy here: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2021-21985&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1&source=NIST https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CV... Down at the "Scope" section there's "changed" and "unchanged". If you click on "changed", it goes from 9.8 to 10.0.
- merb 5y agowhy do people putting their vmware vcenter onto the internet?
- perlgeek 5y agoLots of hosting companies use vcenter for managing their VMs, and if you expose vcenter to your customers, you have a very convenient way to have the powercycle VMs, open consoles and stuff like that. And if you expose it to your customers, you either have to force them to use a VPN (and support it for even their dumbest users), or you expose it on the Internet. Not great security wise, but the economics do push you into that direction.
- fulafel 5y agoAlso, if you look at the vulnerability track record of commercial VPN products recently (some mentioned in this article even), they aren't necessarily any safer to keep publically accessible.
- tyingq 5y agoSadly, it's probably happening more with all the "work from home". I imagine lots of Shodan queries for vcenter right now. Apparently "intitle:id_vc_welcome" returns vcenter servers on Google.
- mschuster91 5y agoEven for WFH: just set up a damn openvpn in front of the vcenter server, if you don't have the money for a Cisco Anyconnect appliance. It's not that hard, and anyone ignorant enough to expose a vCenter to the Internet deserves being shut down. This is unacceptably incompetent.
- ocdtrekkie 5y agoFWIW, attackers are also constantly trying to exploit vulnerabilities in your AnyConnect appliance...
- tptacek 5y agoJust a reminder that these severity ratings, while often directionally useful (a 9.x probably is something you should care about if you run the target software; a 2.x is probably not), the ratings themselves are total horseshit and are running industry joke; literally a Ouija board, starting from a hopelessly ambiguous "calculator" that you run and then apply subtle inputs to to get the score where you want it to be.
- pts_ 5y agoGetting a web shell speaks for itself.
- bawolff 5y agoContext matters a bit. From what i understand its a plugin that's only sometimes used and would typically (but clearly not always) be not exposed to the internet. So its a serious vuln, but not as serious as say if it was in a component that was always exposed to the internet in the core part of vmware. I guess vulns can always be worse. How bad it is depends on how you use vmware. I mean regardless, clearly everyone affected should patch.
- rorykoehler 5y agoI always use them as a guide for what we should talk about first to then give them our own internal rating. Typically vuln criticality is very system specific.
- px43 5y agoThe funny thing about infosec taxonomies is that actual attacks actively resist classifications like CVSS. CVSS is generally used on the sysadmin side to figure out what to patch first. Successful attackers generally go after shit that's unpatched. This often means that the most exploited bugs are the ones with the lowest CVSS scores, so new tools and techniques tend to grow around issues that sysadmins consider to not be a big deal. People eventually catch on that the "no big deal" bugs are getting exploited en-masse, and try to tweak the scoring process, which is why we're on CVSSv3 now with CVSSv4 in the works, and it's just as useless as it's always been.
- colonelxc 5y agoNot even the first preauth VSphere RCE this year: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21972 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2197...
- gwbas1c 5y agoI worked briefly at VMware. An exploit like this doesn't surprise me one bit. We had a company mailing list that people used to email jokes back and forth all the time. One rather ignorant programmer put a rule on his email where he would get an alert whenever anybody emailed him with a particular word in the subject line. That word happened to get into a rather popular email thread, and in the middle of the thread we started getting complaints from him asking us to change the subject line because his pager was beeping off the hook. Career limiting move! He took a lot of heat for making poor assumptions.
- na85 5y agoIt can't be that bad, since I haven't seen a flashy website for this vuln, complete with a logo, making the rounds on social media.
- yarg 5y agoIt needs a cool name too; the VisorShatter breach.
- franciscop 5y agoVMBeware.com is available and a nice catchy name for a VMWare bug IMHO. Please cite me if you use it :)
- KirillPanov 5y agoAll that means is that the first person to find the vuln wasn't a grad student hoping for a faculty job.
- justusthane 5y agoIf you don't use the vCenter plugins in which the vulnerabilities exist (vSAN Health Check, vROPS Manager), it's incredibly easy to mitigate this vulnerability by manually marking these plugins as incompatible: https://kb.vmware.com/s/article/83829 https://kb.vmware.com/s/article/83829
- deleted 5y ago[deleted]
- nick__m 5y agoA poc appears to be available there : https://github.com/xnianq/cve-2021-21985_exp https://github.com/xnianq/cve-2021-21985_exp ! P.s. I use yandex to find CVE POC, google is almost useless for that kind of search and yandex almost always deliver working code !
- scoopertrooper 5y agoGithub search also often does the trick. https://github.com/search?q=cve-2021-21985 https://github.com/search?q=cve-2021-21985
- rootsudo 5y agoNice on the Yandex info. Thank you :)
- nick__m 5y agoMy pleasure if you use that knowledge for good! I use those POC to help the infosec team at work when the bosses postpone patching. There is nothing like a demo to persuade them we must patch now.
- zwp 5y agoNice find. I'm hopefully preaching to the choir here but please beware that high-visibility flaws often attract fake PoCs. Malicious in the sense "might [also] attack the user" (you!). Often these will surf on work done by valid PoCs to look credible. GitHub was stuffed with them for the Hafnium Exchange bug, before Microsoft brought down the ban hammer. (At the time there was lots of mewing about "Microsoft protecting their own" and "Microsoft killing free speech" but I wonder if they weren't also interested in stopping the pwnage from these fake exploits, too). I'm not saying this repo is malicious. This github user looks legitimate and doesn't look like the obviously-created-by-a-bot profiles I've previously seen. Even so I wouldn't necessarily trust ~5000 vendored class files. Play carefully.
- faeyanpiraat 5y agoThis is the reason why I have to stay away from hackintosh with their modified kexts. And have to stay away from pirated games. A compiled executable from a trustworthy vendor gets a score of 1/65 on virustotal? Well, I guess you are running in a sandbox.. A legit library has enormous number of lines? Well I’m rolling my own (except for crypto, noone should roll their own) I just cannot take the risk anymore.
- anonymousiam 5y agoIt's safe to say that anybody who exposes VCenter directly to the web is practicing poor security. I cannot imagine any scenario where this would be required. I manage a few VxRail/vSphere clusters and everything is behind firewalls and VPNs. That said, I understand that this vulnerability basically gives root to anyone with VPN access. In our case, pretty much anyone who has VPN access to the cluster already has root on it anyway.
- t0mas88 5y agoOr anyone that found a small unprivileged point of access in a web app that's on your network somewhere. Now they can escalate to root access to everything.