CVE-2021-22019
📋 TL;DR
This vulnerability allows attackers to cause a denial-of-service condition in VMware vCenter Server by sending specially crafted JSON-RPC messages to the VAPI service on port 5480. Organizations running vulnerable versions of vCenter Server are affected, particularly those with network access to the management interface.
💻 Affected Systems
- VMware vCenter Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete unavailability of vCenter Server management functions, disrupting virtual infrastructure operations and potentially affecting dependent services.
Likely Case
Temporary service disruption requiring restart of affected vCenter Server components, causing management outages.
If Mitigated
Minimal impact with proper network segmentation and access controls preventing unauthorized access to port 5480.
🎯 Exploit Status
Exploitation requires network access but no authentication. The vulnerability is in the JSON-RPC processing logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vCenter Server 7.0 U2c, 6.7 U3o, or 6.5 U3q
Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2021-0020.html
Restart Required: Yes
Instructions:
1. Download the appropriate patch from VMware Customer Connect portal. 2. Apply the patch using vCenter Server Update Planner. 3. Restart vCenter Server services as prompted.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to port 5480/TCP to only trusted management systems
# Example firewall rule (adjust for your environment)
# iptables -A INPUT -p tcp --dport 5480 -s trusted_ip_range -j ACCEPT
# iptables -A INPUT -p tcp --dport 5480 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vCenter Server management interfaces
- Deploy network-based intrusion prevention systems to detect and block malicious JSON-RPC traffic
🔍 How to Verify
Check if Vulnerable:
Check vCenter Server version via vSphere Client: Navigate to Menu > Administration > System Configuration > Nodes > Select vCenter Server > Summary tabCheck Version:
ssh to vCenter Server and run: /usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhostVerify Fix Applied:
Verify version is 7.0 U2c, 6.7 U3o, or 6.5 U3q or later. Test VAPI service functionality after patch.📡 Detection & Monitoring
Log Indicators:
- Unusual traffic patterns on port 5480 in vCenter Server logs
- VAPI service crash or restart events
Network Indicators:
- Malformed JSON-RPC messages to port 5480
- High volume of requests to VAPI endpoint
SIEM Query:
source="vcenter" AND (port=5480 AND (message="malformed" OR message="error" OR message="crash"))