CVE-2021-21985 PoC — Vmware vSphere Client 输入验证错误漏洞

Description

VMWARE VCENTER SERVER VIRTUAL SAN HEALTH CHECK PLUG-IN RCE (CVE-2021-21985) 

介绍

# Vulnerability Details

## VMWARE VCENTER SERVER VIRTUAL SAN HEALTH CHECK PLUG-IN RCE (CVE-2021-21985)
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U2b, 6.7 before 6.7 U3n, and 6.5 before 6.5 U3p) and VMware Cloud Foundation (4.x before 4.2.1 and 3.x before 3.10.2.1).

### This tool help you to explore the vulnerability above.

### Use:
```bash
> git clone https://github.com/sknux/CVE-2021-21985_PoC
> cd CVE-2021-21985_PoC
> chmod +x cve-2021-21985_PoC
> ./cve-2021-21985_PoC
$ Usage: ./poc Target-IP Class/Method(s). To list all class/methods, please use -l option.
> ./cve-2021-21985_PoC -l
$ getClusterCapabilityData
                 getHostCapabilityData
                 getHostsCapabilitiyData
                 getIsDeduplicationSupported
                 getIsEncryptionSupported
                 getIsLocalDataProtectionSupportedOnVc
                 getIsLocalDataProtectionSupportedOnCluster
                 getIsRemoteDataProtectionSupported
                 getIsObjectIdentitiesSupportedOnCluster
                 getIsHistoricalCapacitySupported
                 getIsPerfVerboseModeSupported
                 getIsPerfNetworkDiagnosticModeSupported
                 getIsPerfDiagnosticsFeedbackSupportedOnVc
                 getIsAdvancedClusterSettingsSupported
                 getIsRecreateDiskGroupSupported
                 getIsPurgeInaccessibleVmSwapObjectsSupported
                 getIsUpdateVumReleaseCatalogOfflineSupported
                 getIsVitOnlineResizeSupported
                 getIsImprovedCapacityMonitoringSupportedOnVc
                 getIsVmLevelCapacityMonitoringSupported
                 getIsWhatIfCapacitySupported
                 getIsHostReservedCapacitySupported
                 getIsUnmountWithMaintenanceModeSupported
                 getIsEvacuationStatusSupportedOnCluster
...
...
```

### Credits: https://github.com/alt3kx/CVE-2021-21985_PoC

文件快照

备注