PT-2021-4147 · Vmware · Vcenter Server+1

George Noseevich + 2 · Published 2021-09-21 · Updated 2026-02-07 · CVE-2021-22005

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions prior to the fixed version

Description The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. Thousands of potentially vulnerable servers are accessible through the Internet and are at risk of attacks. There have been real-world incidents where this issue was exploited, including an attack on the European retail giant MediaMarkt, which resulted in a ransom demand of $240 million and the disruption of IT systems and store operations.

Recommendations For versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the Analytics service and port 443 to minimize the risk of exploitation. Additionally, follow best practices such as regularly updating software, being cautious when using online conferencing applications, and not attempting to hide data breaches to reduce the risk of cyber incidents.

Exploit

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

BDU:2021-04740

CVE-2021-22005

Affected Products

Vmware Vcenter

Vcenter Server

References · 48

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vcenter_analytics_file_upload.rb · Exploit
• 🔥 https://github.com/shmilylty/cve-2021-22005-exp · Exploit
• 🔥 https://github.com/rwincey/CVE-2021-22005 · Exploit
• 🔥 https://github.com/TaroballzChen/CVE-2021-22005-metasploit · Exploit
• 🔥 https://github.com/Jun-5heng/CVE-2021-22005 · Exploit
• 🔥 https://github.com/5gstudent/CVE-2021-22005- · Exploit
• 🔥 https://github.com/1ZRR4H/CVE-2021-22005 · Exploit
• 🔥❌ https://github.com/X1pe0/VMWare-CVE-Check · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html · Exploit
• 🔥❌ https://github.com/r0ckysec/CVE-2021-22005 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2021-22005 · Vendor Advisory
• https://vmware.com/security/advisories/VMSA-2021-0020.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04740 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22005 · Security Note
• https://t.me/cibsecurity/29296 · Telegram Post