CVE-2021-21972: 
vSphere vCenter Server vulnerability analysis and mitigation

The vSphere Client (HTML5) contains a critical remote code execution vulnerability (CVE-2021-21972) in a vCenter Server plugin, discovered by Mikhail Klyuchnikov of Positive Technologies and disclosed on February 23, 2021. This vulnerability affects VMware vCenter Server versions 7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n, as well as VMware Cloud Foundation versions 4.x before 4.2 and 3.x before 3.10.1.2. The vulnerability received a critical CVSSv3 score of 9.8 out of 10.0 (VMware Advisory, Tenable Blog).

CVE-2021-21972 is an unauthorized file upload vulnerability in the vRealize Operations vCenter Plugin. The vulnerability stems from a lack of authentication in the plugin, which is available in all default installations of vCenter Server, regardless of whether vRealize Operations is present. An unauthenticated, remote attacker with network access to port 443 can exploit this vulnerability by uploading a specially crafted file to a vulnerable vCenter Server endpoint. For Windows systems, attackers can upload a malicious .jsp file to gain SYSTEM privileges, while for Linux systems, attackers can generate and upload a public key to the server's authorized_keys path and connect via SSH (Tenable Blog).

Successful exploitation of this vulnerability allows attackers to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. According to a Shodan search, over 6,700 vCenter Server systems were identified as publicly accessible, making this vulnerability particularly concerning. The widespread exposure and critical severity of this vulnerability pose significant risks to affected organizations (Tenable Blog, Rapid7 Blog).

VMware released patches for affected versions: vCenter Server 6.5 U3n, 6.7 U3l, and 7.0 U1c. For Cloud Foundation, versions 3.10.1.2 and 4.2 were released to address this vulnerability. If immediate patching is not feasible, VMware provided temporary workaround instructions that involve modifying the compatibility matrix file and setting the vRealize Operations vCenter Plugin to incompatible. However, this should only be used as a temporary solution until upgrading is possible (VMware Advisory).

Security researchers and industry experts quickly recognized the severity of this vulnerability. Troy Mursch, chief research officer at Bad Packets, reported detecting mass scanning activity searching for vulnerable vCenter servers within 24 hours of the advisory's publication. The security community drew parallels to previous critical vulnerabilities discovered by the same researcher, Mikhail Klyuchnikov, including CVE-2019-19781 in Citrix ADC and CVE-2020-5902 in F5 BIG-IP (Tenable Blog).