🔙 목록으로 돌아가기

CVE-2021-22005: VMware vCenter Server - Arbitrary File Upload

TitleVMware vCenter Server - Arbitrary File Upload
AuthorPR3R00T
SeverityCritical
ImpactAllows an attacker to upload and execute arbitrary files on the target system
RemediationApply the necessary security patches or updates provided by VMware
CVSS Score9.8
EPSS Score0.94457
CVE IDCVE-2021-22005
CWE IDCWE-22
Tags cve2021 cve vmware vcenter fileupload kev intrusive vkev vuln

🔍 Vulnerability Description

VMware vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /analytics/telemetry/ph/api/hyper/send?_c&_i=test HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Content-Length: 9
Content-Type: application/json
Accept-Encoding: gzip

test_data

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22005.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-22005.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A