CVE-2021-21972 PoC — VMware vSphere Client 路径遍历漏洞

Source

https://github.com/password520/CVE-2021-21972

Associated Vulnerability

Title:VMware vSphere Client 路径遍历漏洞 (CVE-2021-21972)
Description:VMware vSphere Client是美国威睿（VMware）公司的一个应用软件。提供虚拟化管理。 VMware vSphere Client存在路径遍历漏洞，未授权的攻击者可以通过开放443端口的服务器向vCenter Server发送精心构造的请求，从而在目标系统上远程执行恶意代码。以下产品和版本受到影响：vSphere Client 6.5、vSphere Client 6.7、vSphere Client 7.0、VMware Cloud Foundation（vCenter Server）

Readme

# CVE-2021-21972
CVE-2021-21972


# Works On

- VMware-VCSA-all-6.7.0-8217866、VMware-VIM-all-6.7.0-8217866 ✔
- VMware-VCSA-all-6.5.0-16613358 ✔

# For vCenter6.7 U2+
vCenter 6.7U2+ running website in memory,so this exp can't work for 6.7 u2+.

# Need test

- ~~vCenter 6.5 Linux(VCSA)/Window **Waiting For Test**~~
- ~~vCenter 6.7 Linux(VCSA)/Window **Waiting For Test**~~
- ~~vCenter 7.0 Linux(VCSA)/Window **Waiting For Test**~~

# Details

1. 漏洞为任意文件上传
2. 存在问题的接口为`/ui/vropspluginui/rest/services/uploadova`，完整路径（`https://domain.com/ui/vropspluginui/rest/services/uploadova`）
3. 仓库内的`payload`文件夹内的`tar`文件为默认冰蝎3 webshell

#  Screenshots

## Runtime

![3.png](/img/3.png)

## Success



![1.png](/img/1.png)

![1.png](/img/2.png)

# 声明

- 工具仅用于安全人员安全测试与研究使用，任何未授权检测造成的直接或者间接的后果及损失，均由使用者本人负责。
- The tool is only used for security testing and research by security personnel. Any direct or indirect consequences and losses caused by unauthorized testing are the responsibility of the user.

File Snapshot


 [4.0K]  /data/pocs/6a75a9c530a35e9c5455675a766bcf6180143360
├── [6.3K]  CVE-2021-21972.py
├── [4.0K]  img
│   ├── [114K]  1.png
│   ├── [132K]  2.png
│   └── [296K]  3.png
├── [4.0K]  payload
│   ├── [4.0K]  Linux
│   │   └── [ 633]  shell.jsp
│   ├── [3.0K]  Linux.tar
│   └── [ 10K]  Windows.tar
└── [1.2K]  README.md

3 directories, 8 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!