CVE-2021-22005
📋 TL;DR
CVE-2021-22005 is a critical arbitrary file upload vulnerability in VMware vCenter Server's Analytics service. Attackers with network access to port 443 can upload malicious files to execute arbitrary code on the vCenter Server. This affects organizations running vulnerable versions of vCenter Server.
💻 Affected Systems
- VMware vCenter Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of vCenter Server leading to full control of virtual infrastructure, data exfiltration, ransomware deployment, and lateral movement to connected systems.
Likely Case
Remote code execution on vCenter Server allowing attackers to steal credentials, manipulate virtual machines, and establish persistence in the environment.
If Mitigated
Limited impact if proper network segmentation, access controls, and monitoring are in place to detect and block exploitation attempts.
🎯 Exploit Status
Multiple public exploit scripts available. Actively exploited in the wild. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vCenter Server 7.0 U2c, 6.7 U3o, 6.5 U3q
Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2021-0020.html
Restart Required: Yes
Instructions:
1. Download appropriate patch from VMware portal. 2. Backup vCenter Server. 3. Apply patch using vCenter Server Update Planner. 4. Restart vCenter Server services.
🔧 Temporary Workarounds
Disable Analytics Service
linuxTemporarily disable the vulnerable Analytics service to block exploitation
service-control --stop vmware-analytics
service-control --stop vsphere-ui
Network Segmentation
allRestrict access to vCenter Server port 443 to trusted management networks only
🧯 If You Can't Patch
- Implement strict network access controls to limit access to vCenter Server port 443
- Deploy web application firewall rules to block file upload attempts to the Analytics service endpoint
🔍 How to Verify
Check if Vulnerable:
Check vCenter Server version and compare against patched versions. Also check if /analytics/telemetry/ph/api/hyper/send endpoint is accessible.Check Version:
On vCenter Server Appliance: cat /etc/vmware-vpx/versionVerify Fix Applied:
Verify vCenter Server version matches patched versions and test that file upload to Analytics service endpoint is blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /analytics/telemetry/ph/api/hyper/send
- Suspicious process execution from unexpected locations
- Failed authentication attempts followed by successful file upload
Network Indicators:
- POST requests to /analytics/telemetry/ph/api/hyper/send with file uploads
- Outbound connections from vCenter Server to unknown external IPs
SIEM Query:
source="vcenter.log" AND (url="/analytics/telemetry/ph/api/hyper/send" OR process="cmd.exe" OR process="powershell.exe")🔗 References
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005
