{"id":7541,"date":"2021-05-31T20:27:06","date_gmt":"2021-06-01T03:27:06","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7541"},"modified":"2023-04-05T12:40:14","modified_gmt":"2023-04-05T19:40:14","slug":"cve-2021-21985-patch-this-vmware-trending-vulnerability","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/cve-2021-21985-patch-this-vmware-trending-vulnerability\/","title":{"rendered":"CVE-2021-21985: Patch this Trending VMware Vulnerability"},"content":{"rendered":"<p>On the 25<sup>th<\/sup> of May 2021, VMware published an <a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2021-0010.html\" target=\"_blank\" rel=\"noopener\">advisory<\/a> warning of two vulnerabilities &#8211; CVE-2021-21985 and CVE-2021-21986 &#8211; in their vCenter Server and Cloud Foundation products. Researchers at Cyber Security Works (CSW) analysed these vulnerabilities from a Pentester\u2019s perspective and here is their verdict.<\/p>\n<blockquote>\n<p style=\"font-style: italic;\"><b id=\"docs-internal-guid-032a75b4-7fff-ba71-d390-40cfab77ebaa\">\u201cIf not patched, a hacker could exploit CVE-2021-21985 to execute commands with unrestricted privileges on the host operating system and compromise the same.\u201d<\/b><\/p>\n<p style=\"font-style: italic;\">A Pentester\u2019s Perspective<\/p>\n<\/blockquote>\n<h3 dir=\"ltr\">Malicious Attackers on the Hunt for Unpatched VMware vCenter Versions<\/h3>\n<p dir=\"ltr\">A week after CSW\u2019s analysis of CVE-2021-21985, our prediction about attackers targeting unpatched VMware vCenter versions is coming true. Recently, a security researcher published a <a href=\"https:\/\/www.iswin.org\/2021\/06\/02\/Vcenter-Server-CVE-2021-21985-RCE-PAYLOAD\/\" target=\"_blank\" rel=\"noopener\">proof of concept<\/a> Remote Code Execution (RCE) exploit code on June 2, 2021. Two days later, <a href=\"https:\/\/us-cert.cisa.gov\/ncas\/current-activity\/2021\/06\/04\/unpatched-vmware-vcenter-software\" target=\"_blank\" rel=\"noopener\">CISA <\/a>noticed that threat actors were scouring the Internet for unpatched vCenter servers to misuse the vulnerability. Further <a href=\"https:\/\/arstechnica.com\/gadgets\/2021\/06\/under-exploit-vmware-vulnerability-with-severity-rating-of-9-8-out-of-10\/\" target=\"_blank\" rel=\"noopener\">attempts were also identified<\/a> in the wild, where attackers tried to compromise servers that ran vulnerable software versions.<\/p>\n<h3 dir=\"ltr\">CVE-2021-21985 : Why is it so dangerous?<\/h3>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">According to <a href=\"https:\/\/packetstormsecurity.com\/files\/cve\/CVE-2021-21985\" target=\"_blank\" rel=\"noopener\">Packetstorm<\/a>, the vulnerability can be remotely exploited by an attacker, and used to run custom code to gain unauthenticated access.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">The CVE has a CVSS V3 score of 9.8, making it a highly critical vulnerability.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">The CVE is a manifestation of Common Weakness Enumeration &#8211; 20 (CWE &#8211; 20), the third most dangerous software weakness of 2020, according to MITRE. This vulnerability could lead to improper or incorrect validation of a user\u2019s request, and processing unsafe data.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">The CVE has been trending in the wild since May 25th 2021, which was when the vulnerability was disclosed by VMware.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">The CVE is seen <a href=\"https:\/\/trends.google.com\/trends\/explore?date=now%207-d&amp;q=CVE-2021-21985\" target=\"_blank\" rel=\"noopener\">trending<\/a> in North America, Europe and the Asia-Pacific (APAC) region.<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\" role=\"presentation\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<img decoding=\"async\" src=\"https:\/\/lh4.googleusercontent.com\/o_wJpc5YpQMHJOcZooa5Nksy6HkYvgDutC3q-Mic8kqYisMnx0Hr35aD2S8-osInAh0Ve6FQHq_Gb9luLM2GQHXc-f74qWhRk8GmIRfod_TczWqVuXS6pVLobR0KtBxeXlsIJLvX\" \/>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<b>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/b>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<span style=\"font-size: 11px;\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<\/span><b>\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<\/b><\/p>\n<h3 dir=\"ltr\">Vulnerable Products<\/h3>\n<p dir=\"ltr\">The vulnerability is seen in multiple software versions of VMware vCenter, an advanced server management tool providing a centralized platform for controlling vSphere environments, for visibility across hybrid clouds.<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">22 versions of vCenter server are found to be affected by the CVE &#8211; versions 6.5, 6.5 U1, 6.5 U3, 6.5 U3n, 6.5.0, 6.5.0a, 6.5.0b, 6.5.0c, 6.5.0d, 6.5u2c, 6.7, 6.7 U3, 6.7 U3l, 6.7 U3m, 6.7.0, 6.7.0d, 6.7u3f, 7.0, 7.0 U1a, 7.0 U1b, 7.0 U1c and 7.0 U2a.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">The vulnerability is also seen to impact VMware Cloud Foundation (VCF) which provides multiple cloud services &#8211; compute virtualization, storage virtualization, network virtualization and cloud management and monitoring &#8211; via a single platform, based on a shared security responsibility model.<\/p>\n<\/li>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">15 versions of VCF that include versions 3.0, 3.0.1, 3.0.1.1, 3.5, 3.5.1, 3.7, 3.7.1, 3.7.2, 3.8, 3.9, 3.9.1, 3.10, 3.10.1.2, 4.0 and 4.2 are impacted.<\/p>\n<\/li>\n<\/ul>\n<p>VMware has released updated versions after fixing the vulnerability for each of the affected products, and provided workarounds as well. These can be found in their <a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2021-0010.html\" target=\"_blank\" rel=\"noopener\">advisory page<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<h3 dir=\"ltr\">What is the Global Exposure?<\/h3>\n<p dir=\"ltr\">A global exposure analysis using Shodan shows that many product versions with the vulnerability are being widely used.<\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">There are 5342 instances of VMware vCenter Server exposed to the Internet, with around 25% of the instances being found in the United States.<\/p>\n<\/li>\n<\/ul>\n<p dir=\"ltr\"><b id=\"docs-internal-guid-032a75b4-7fff-ba71-d390-40cfab77ebaa\">\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0<img decoding=\"async\" src=\"https:\/\/lh3.googleusercontent.com\/MZGtDY1nea9w7VIZN6_XQil2rUPH-flVp5ZVIMoWGcPIiV1aveYcjt2NbSzPY89n0hJIWqXzHgkoQTISyQh9SrURk7230VuUN6Hg9qZkToQnNGVq4D_58dj6ke8Ov26sffPpF5v1\" width=\"249\" height=\"360\" \/><\/b><\/p>\n<ul>\n<li dir=\"ltr\" aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">5127 instances of port 443 are prone to being exploited by attackers, the top most entry point for an attack that could compromise the host operating system even. Ports 8443, 9443, 4443 and 444 could also serve as possible attack vectors.\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0<b id=\"docs-internal-guid-11b8df31-7fff-f643-665a-ee96e7be02d0\"><img decoding=\"async\" src=\"https:\/\/lh4.googleusercontent.com\/M7ehOEOhaKLsRSyx9Ai9erm3xQsK1enQwXJiugv-CFY-8ykrR5nob8xOISnhiWq4oRg6-YZ2BBr36zLlhOgTtwxIGSd317L8QRx4bXsA-sGNq3PcOH2CDFyEh7PwLJ2w4Bjc4qFJ\" width=\"247\" height=\"192\" \/><\/b><\/p>\n<ul>\n<li aria-level=\"1\">\n<p dir=\"ltr\" role=\"presentation\">VMware vCenter server version 6.7 seems to be the most used product with over 2000 instances spread across the United States, Germany, China, Turkey and the United Kingdom.\u00a0 \u00a0 \u00a0<b id=\"docs-internal-guid-7d35016c-7fff-b107-f0e8-8c2d666e5f7c\"><img decoding=\"async\" src=\"https:\/\/lh6.googleusercontent.com\/jW0TU15RKCoM7DQKF8v9025nI60mXp6t9zM3guNIbnq650e4f5qghFV0NqlPJWj-6fW9-7hIhjcWM1hrkrkbpvOBhva7haJh6CnOgD3KETZ5IKi4T-caKO5O2IePC2NDvYrgpIjG\" width=\"602\" height=\"305\" \/><\/b><\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Prioritise the patch to avoid another Darkside<\/h3>\n<p dir=\"ltr\">From our analysis of the new 2021 vulnerability CVE-2021-21985, it is clear that the CVE could be used in any ransomware attack. In our <a href=\"https:\/\/cybersecurityworks.com\/ransomware\/\" target=\"_blank\" rel=\"noopener\">Ransomware Report<\/a> we published in the first half of May 2021, we noticed how Darkside exploited a newly trending vulnerability and added it to its weaponry within 8 days of the CVE being discovered. We urge you to <a href=\"https:\/\/www.vmware.com\/security\/advisories\/VMSA-2021-0010.html\" target=\"_blank\" rel=\"noopener\">patch<\/a> this vulnerability and proactively defend against cyberattacks.<\/p>\n<p>&nbsp;<\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><span style=\"font-size: 18px;\">Bogged down by a long list of vulnerabilities? Not sure where to start?<\/span><\/p>\n<p dir=\"ltr\" style=\"text-align: center;\"><span style=\"font-size: 18px;\"><a href=\"https:\/\/cybersecurityworks.com\/get-quote.php\" target=\"_blank\" rel=\"noopener\">We can help you prioritize the ones that need immediate attention!<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>On the 25th of May 2021, VMware published an advisory warning of two vulnerabilities &#8211; CVE-2021-21985 and CVE-2021-21986 &#8211; in their vCenter Server and Cloud Foundation products.<\/p>\n","protected":false},"author":1,"featured_media":14341,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[82,80,123],"tags":[250,218,404,139],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7541"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=7541"}],"version-history":[{"count":3,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7541\/revisions"}],"predecessor-version":[{"id":14342,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7541\/revisions\/14342"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/14341"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=7541"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=7541"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=7541"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}