CVE-2021-21972 PoC — VMware vSphere Client 路径遍历漏洞

Source

https://github.com/NS-Sp4ce/CVE-2021-21972

Associated Vulnerability

Title:VMware vSphere Client 路径遍历漏洞 (CVE-2021-21972)
Description:The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Description

CVE-2021-21972 Exploit

Readme

# CVE-2021-21972
CVE-2021-21972


# Works On

- VMware-VCSA-all-6.7.0-8217866、VMware-VIM-all-6.7.0-8217866 ✔
- VMware-VCSA-all-6.5.0-16613358 ✔

# For vCenter6.7 U2+
vCenter 6.7U2+ running website in memory,so this exp can't work for 6.7 u2+.

# Need test

- ~~vCenter 6.5 Linux(VCSA)/Window **Waiting For Test**~~
- ~~vCenter 6.7 Linux(VCSA)/Window **Waiting For Test**~~
- ~~vCenter 7.0 Linux(VCSA)/Window **Waiting For Test**~~

# Details

1. 漏洞为任意文件上传
2. 存在问题的接口为`/ui/vropspluginui/rest/services/uploadova`，完整路径（`https://domain.com/ui/vropspluginui/rest/services/uploadova`）
3. 仓库内的`payload`文件夹内的`tar`文件为默认冰蝎3 webshell

#  Screenshots

## Runtime

![3.png](/img/3.png)

## Success



![1.png](/img/1.png)

![1.png](/img/2.png)

# 声明

- 工具仅用于安全人员安全测试与研究使用，任何未授权检测造成的直接或者间接的后果及损失，均由使用者本人负责。
- The tool is only used for security testing and research by security personnel. Any direct or indirect consequences and losses caused by unauthorized testing are the responsibility of the user.

File Snapshot


 [4.0K]  /data/pocs/9e1ed51bb309d8395d13cd3186e096e726cd1cb0
├── [9.7K]  CVE-2021-21972.py
├── [4.0K]  img
│   ├── [114K]  1.png
│   ├── [132K]  2.png
│   └── [296K]  3.png
├── [4.0K]  payload
│   ├── [4.0K]  Linux
│   │   └── [ 633]  shell.jsp
│   ├── [3.0K]  Linux.tar
│   └── [ 10K]  Windows.tar
└── [1.2K]  README.md

3 directories, 8 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!