Overview
According to NSFOCUS CERT’s monitoring, VMware’s official security advisory, disclosing multiple vulnerabilities in VMware vCenter Server on September 22. Those issues allow attackers to cause information disclosure, privilege promotion and remote code execution. Now VMware has released security updates to fix the vulnerabilities. Affected users are advised to take measures for protection.
vCenter Server is a server management solution from VMware to help IT administrators manage virtual machines and hosts in enterprise environments via a single console.
Reference link:
https://www.vmware.com/security/advisories/VMSA-2021-0020.html
Description of Major Vulnerabilities
vCenter Server arbitrary file upload vulnerability (CVE-2021-22005)
An unauthenticated attacker could exploit this vulnerability to execute arbitrary code with user privileges by using the Analytics service to upload a crafted file to port 443 of the vCenter Server. This vulnerability has a CVSS score of 9.8.
vCenter Server Privilege Escalation Vulnerability (CVE-2021-21991)
Due to vCenter Server not properly handling session tokens, this vulnerability allows an attacker with non-administrative user access to elevate to administrative privileges of vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash). This vulnerability has a CVSS score of 8.8.
vCenter Server Reverse Proxy Bypass Vulnerability (CVE-2021-22006):
As the endpoint fails to properly handle URLs, an unauthenticated attacker could exploit this vulnerability to access the restricted endpoint via port 443 of vCenter Server. This vulnerability has a CVSS score of 8.3.
vCenter Server Unauthenticated API Endpoints Vulnerability (CVE-2021-22011):
As the content library of vCenter Server is prone to an unauthenticated API endpoint vulnerability, an unauthenticated attacker could exploit this vulnerability to perform VM network settings. This vulnerability has a CVSS score of 8.1.
vCenter Server Local Privilege Escalation Vulnerability (CVE-2021-22015)
Due to the improper control of file and directory permissions, vCenter Server contains multiple local privilege escalation vulnerabilities that allow an attacker with non-administrative user access to escalate to root privileges on vCenter Server Appliance. This vulnerability has a CVSS score of 7.8.
Scope of Impact
Affected Versions
- VMware vCenter Server 7.0 series < 7.0 U2c
- VMware vCenter Server 6.7 series < 6.7 U3o
- VMware vCenter Server 6.5 series < 6.5 U3q
- Cloud Foundation (vCenter Server) 4.x series < 4.3
- Cloud Foundation (vCenter Server) 3.x series < 3.10.2.2
Unaffected Versions
- VMware vCenter Server 7.0 U2c
- VMware vCenter Server 6.7 U3o
- VMware vCenter Server 6.5 U3q
- Cloud Foundation (vCenter Server) 4.3
- Cloud Foundation (vCenter Server) 3.10.2.2
Mitigation
Official Fix
Currently, the vendor has fixed this vulnerability in the latest versions. Affected users are advised to upgrade as soon as possible from the following links:
| Product Version | Download Link | Operation Guide |
| vCenter Server 7.0 U2d | https://customerconnect.vmware.com/downloads/details?downloadGroup=VC70U2D&productId=974&rPId=74352 | https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-vcenter-server-70u2d-release-notes.html |
| vCenter Server 6.7 U3o | https://customerconnect.vmware.com/downloads/details?downloadGroup=VC67U3O&productId=742&rPId=73667 | https://docs.vmware.com/en/VMware-vSphere/6.7/rn/vsphere-vcenter-server-67u3o-release-notes.html |
| vCenter Server 6.5 U3q | https://customerconnect.vmware.com/downloads/details?downloadGroup=VC65U3Q&productId=614&rPId=74057 | https://docs.vmware.com/en/VMware-vSphere/6.5/rn/vsphere-vcenter-server-65u3q-release-notes.html |
| VMware vCloud Foundation 4.3.1 | https://docs.vmware.com/en/VMware-Cloud-Foundation/4.3.1/rn/VMware-Cloud-Foundation-431-Release-Notes.html | |
| VMware vCloud Foundation 3.10.2.2 | https://docs.vmware.com/en/VMware-Cloud-Foundation/3.10.2/rn/VMware-Cloud-Foundation-3102-Release-Notes.html |
For common FAQs, please refer to https://via.vmw.com/vmsa-2021-0020-faq
Workaround
For the arbitrary file upload vulnerability (CVE-2021-22005) of VMware vCenter Server, please refer to the workaround from the official link: https://kb.vmware.com/s/article/85717
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
About NSFOCUS
NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.
NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA). A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.
