CVE-2021-21985 PoC — Vmware vSphere Client 输入验证错误漏洞

Source

https://github.com/sknux/CVE-2021-21985_PoC

Associated Vulnerability

Title:Vmware vSphere Client 输入验证错误漏洞 (CVE-2021-21985)
Description:Vmware vSphere Client是美国威睿（Vmware）公司的一个应用软件。提供虚拟化管理。 Vmware vSphere Client 存在输入验证错误漏洞，该漏洞由于vCenter Server默认启用的虚拟SAN健康检查插件缺乏输入验证，导致攻击者可以在底层操作系统上以不受限制的权限执行命令。

Description

VMWARE VCENTER SERVER VIRTUAL SAN HEALTH CHECK PLUG-IN RCE (CVE-2021-21985)

Readme

# Vulnerability Details

## VMWARE VCENTER SERVER VIRTUAL SAN HEALTH CHECK PLUG-IN RCE (CVE-2021-21985)
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U2b, 6.7 before 6.7 U3n, and 6.5 before 6.5 U3p) and VMware Cloud Foundation (4.x before 4.2.1 and 3.x before 3.10.2.1).

### This tool help you to explore the vulnerability above.

### Use:
```bash
> git clone https://github.com/sknux/CVE-2021-21985_PoC
> cd CVE-2021-21985_PoC
> chmod +x cve-2021-21985_PoC
> ./cve-2021-21985_PoC
$ Usage: ./poc Target-IP Class/Method(s). To list all class/methods, please use -l option.
> ./cve-2021-21985_PoC -l
$ getClusterCapabilityData
                 getHostCapabilityData
                 getHostsCapabilitiyData
                 getIsDeduplicationSupported
                 getIsEncryptionSupported
                 getIsLocalDataProtectionSupportedOnVc
                 getIsLocalDataProtectionSupportedOnCluster
                 getIsRemoteDataProtectionSupported
                 getIsObjectIdentitiesSupportedOnCluster
                 getIsHistoricalCapacitySupported
                 getIsPerfVerboseModeSupported
                 getIsPerfNetworkDiagnosticModeSupported
                 getIsPerfDiagnosticsFeedbackSupportedOnVc
                 getIsAdvancedClusterSettingsSupported
                 getIsRecreateDiskGroupSupported
                 getIsPurgeInaccessibleVmSwapObjectsSupported
                 getIsUpdateVumReleaseCatalogOfflineSupported
                 getIsVitOnlineResizeSupported
                 getIsImprovedCapacityMonitoringSupportedOnVc
                 getIsVmLevelCapacityMonitoringSupported
                 getIsWhatIfCapacitySupported
                 getIsHostReservedCapacitySupported
                 getIsUnmountWithMaintenanceModeSupported
                 getIsEvacuationStatusSupportedOnCluster
...
...
```

### Credits: https://github.com/alt3kx/CVE-2021-21985_PoC

File Snapshot


 [4.0K]  /data/pocs/3e5655c94160150f2619bc0e7db31106eccbc249
├── [1.5K]  cve-2021-21985_PoC
└── [2.1K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!