VMWARE VCENTER CLIENT ARCHIVE
VMWARE VCENTER CLIENT SOFTWARE
VMWARE VCENTER CLIENT CODE

It means, vCenter is ready to accept the file as input. In th e above response, it is looking for the вЂ uploadFile вЂ™ parameter in the POST request. $ curl вЂ“ i -s -k -X $вЂ™POSTвЂ™ $вЂ™вЂ™ POST request This is validated by sending the same request with POST method. $ curl вЂ“ i -s -k $вЂ™вЂ™ POST request allowed

We can see that GET is not allowed, POST is allowed: $ curl вЂ“ i -s -k $вЂ™вЂ™ query to validate the serverД®ven with an unauthorized request to / ui / vropspluginui /rest/services/*, the server responds with 200 OK. V alidate th e vulnerability by sending below quer y to the server : Get webshell by entering the w ebshell address on attacke r machine.Get reverse shell by connecting from attacker machine.If yes, u pload a customized payload with public key or w ebshell in it.Validate whether the server is vulnerable or not.To exploit the server, we try to do the following:

VMWARE VCENTER CLIENT CODE

Verify the uploaded test file: verifying the uploaded test file Remote Code Execution : Upload the file to vulnerable server without authentication : file upload to the server

VMWARE VCENTER CLIENT ARCHIVE

We demonstrate this with below steps:Д¬reate a dummy test file-based archive: test file archive Therefore, it is combination of authentication bypass and directory traversal. As a result, attackers can upload malicious files to their intended locations.ДЄlthough the вЂњ/ ui / vropspluginui /rest/services/ uploadova вЂќ endpoint is supposed to be accessed only by an authenticated user, we could see that it is accessible without authentication as well. It parse s the f ile name from the file object header and concatenat es the extracted path to the base path without checking the f ile name for directory traversal characters such as вЂњ.вЂќ. java extracts non-directory file objects from OVA to вЂњ / tmp / unicorn_ova_dir вЂќ folder. Once an OVA file is uploaded, t he request handler method uploadOvaFile implemented in com/ vmware / vropspluginui / mvc / ServicesController. VSphere client plugin uses вЂњ/ ui / vropspluginui /rest/services/ uploadova вЂќ endpoint to receive OVA files. VSphere client is accessible through web browser : client access Д«elow are how the network details looks like while configuring the server : vCenter server detailsД«elow marked is the vulnerable vCenter server version : Vulnerable vCenter serverД«elow marked is the vulnerable vCenter server build number : Vulnerable vCenter server build In our lab, we hosted VMware vCenter 6.5 bu022 t o recreate the attack scenari o.

In this blog, letвЂ™s take a close look at how this vulnerability works. More details about CVE-2021-2 1972 and various affected versions can be found at NVD. This vulnerability has been assigned CVE-2021-21972. It is because of i mproper validation of directory paths in the uploaded tar archive ( OVA). ДЄ r emote c ode e xecution v ulnerability has been recently reported in the vSphere client plugin of VMware vCenter server. It is widely used by e nterpri s es for their production and testing of application servers both in their local networks as well as in their hybrid cloud infrastructure.

VMWARE VCENTER CLIENT SOFTWARE

VMware vCenter Server is the centralized server management software for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location.

Vmware vcenter client