Critical VMware vCenter Vulnerability

THE THREAT

On September 21st, VMware announced a critical vulnerability impacting VMware vCenter servers. The vulnerability is a file upload vulnerability tracked as CVE-2021-22005 (CVSS: 9.8). Exploitation would allow a threat actor to execute remote code on vulnerable systems by uploading a specially crafted malicious file. Previous authentication is not required for exploitation.

Organizations are strongly recommended to apply the relevant security patch as soon as possible. Exploitation has not been identified in the wild at this time but is expected in the near future.

What we’re doing about it

• eSentire Managed Vulnerability Service (MVS) will automatically add the relevant plugins for this vulnerability once details are made available
• eSentire security teams are tracking this threat for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches provided by VMware
  • If patching is not currently possible, VMware has provided temporary mitigations until patches can be deployed
• Ensure that vCenter Servers are not directly exposed to the internet

Additional information

CVE-2021-22005 impacts vCenter Server 6.7 and 7.0. Exploitation requires that a vulnerable version of vCenter be accessible over port 443. While exploitation has not been publicly identified at this time, it is expected in the near future. CVE-2021-22005 is considered trivial to exploit and would provide significant access to threat actors; these factors increase the likelihood that threat actors will focus on this vulnerability, and attempt to exploit it before organizations have widely deployed patches.

In addition to CVE-2021-22005, VMware addressed 18 other vulnerabilities. These vulnerabilities are not considered critical but should be addressed with the available security patches.

References:

[1] https://blogs.vmware.com/vsphere/2021/09/vmsa-2021-0020-what-you-need-to-know.html
[2] https://kb.vmware.com/s/article/85717
[3] https://www.vmware.com/security/advisories/VMSA-2021-0020.html