PT-2021-3176 · Vmware · Vcenter Server+3

Ricter Z · Published 2021-05-25 · Updated 2026-02-07 · CVE-2021-21985

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vSphere Client (HTML5) (affected versions not specified) VMware vCenter Server (affected versions not specified)

Description The issue exists due to insufficient input validation in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server. This allows a remote attacker to execute arbitrary commands with unrestricted privileges on the underlying operating system by sending a specially crafted HTTP request to port 443.

Recommendations As a temporary workaround, consider disabling the Virtual SAN Health Check plug-in until a patch is available. Restrict access to port 443 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SSRF

Weakness Enumeration

CWE-20

CWE-470

CWE-918

Related Identifiers

BDU:2021-02848

CVE-2021-21985

Affected Products

Vmware Vcenter

Virtual San Health Check

Vcenter Server

Vsphere Client

References · 40

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vcenter_vsan_health_rce.rb · Exploit
• 🔥 https://github.com/alt3kx/CVE-2021-21985_PoC · Exploit
• 🔥 https://github.com/xnianq/cve-2021-21985_exp · Exploit
• 🔥 https://github.com/testanull/Project_CVE-2021-21985_PoC · Exploit
• 🔥 https://github.com/daedalus/CVE-2021-21985 · Exploit
• 🔥 https://github.com/sknux/CVE-2021-21985_PoC · Exploit
• 🔥 https://github.com/onSec-fr/CVE-2021-21985-Checker · Exploit
• 🔥❌ https://github.com/r0ckysec/CVE-2021-21985 · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Check-Remote-Code-Execution.html · Exploit
• https://vmware.com/security/advisories/VMSA-2021-0010.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21985 · Security Note
• https://bdu.fstec.ru/vul/2021-02848 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21985 · Vendor Advisory
• https://t.me/rnetsec/15035 · Telegram Post
• http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html · Note