CVE-2021-21972 PoC — VMware vSphere Client 路径遍历漏洞

Source

https://github.com/yaunsky/CVE-2021-21972

Associated Vulnerability

Title:VMware vSphere Client 路径遍历漏洞 (CVE-2021-21972)
Description:The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Readme

# CVE-2021-21972

### 漏洞描述

cve-2021-21972代码执行漏洞

具有443端口访问权限的恶意攻击者可以通过向`vCenter Server`发送精心构造的请求，最终造成远程任意代码执行。

### 漏洞检测

1、漏洞为任意文件上传

2、漏洞存在的接口为

`/ui/vropspluginui/rest/services/uploadova`，

完整路径

`https://domain.com/ui/vropspluginui/rest/services/uploadova`

### 修复建议

\- `vCenter Server`7.0版本升级到7.0.U1c

\- `vCenter Server`6.7版本升级到6.7.U3l

\- `vCenter Server`6.5版本升级到6.5 U3n

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →