VMware fixes critical RCE bug in all default vCenter installs

VMware has addressed a critical remote code execution (RCE) vulnerability in the vCenter Server virtual infrastructure management platform that may allow attackers to potentially take control of affected systems.

vCenter Server helps IT admins manage virtualized hosts and virtual machines within enterprise environments via a single console.

Critical RCE scoring almost a perfect severity score

The privately reported vulnerability is tracked as CVE-2021-21972, and it was rated with a CVSSv3 base score of 9.8 out of 10 according to VMware's security advisory.

CVE-2021-21972 was reported by Mikhail Klyuchnikov of Positive Technologies, and it can be exploited remotely by unauthenticated attackers in low complexity attacks that don't require user interaction.

"The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin," VMware explains in the advisory.

"A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server."

The impacted vCenter Server plugin for vRealize Operations (vROps) is present in all default installations, with vROPs not being required for the affected endpoint to be available.

VMware fixed an Unauth RCE in vCenter (CVE-2021-21972) found by our researcher Mikhail Klyuchnikov.

CVSS: 9.8

Advisory: https://t.co/8ylVdvcUqr pic.twitter.com/9g1gPboaap

— PT SWARM (@ptswarm) February 23, 2021

Workaround available

Due to this security vulnerability's critical nature, it is strongly recommended to upgrade vulnerable vCenter Server installations as soon as possible.

To patch the vulnerability, you have to upgrade affected installations to vCenter Server 6.5 U3n, 6.7 U3l, or 7.0 U1c.

VMware also provides a workaround that removes the possibility of exploitation for those who cannot immediately update to a version that patches the CVE-2021-21972 security flaw. 

Detailed steps on implementing the workaround on Linux-based virtual appliances (vCSA) can be found in VMware's KB82374 support document.

VMware also fixed today an important heap-overflow vulnerability (tracked as CVE-2021-21974) in VMware ESXi  that may enable attackers to execute arbitrary code remotely on impacted devices.

In April 2020, VMware addressed another critical vCenter Server vulnerability that could've allowed attackers to access sensitive information and potentially take control of impacted Windows systems or virtual appliances.

Comments are closed.