VMware vCenter Critical RCE Vulnerability

Tim

29th September 2021

4 min read

Last week, VMware released a security advisory that contained information regarding several high severity vulnerabilities, which are present within all currently supported versions of the vCenter Server virtualisation management software.

Security researchers George Noseevich and Sergey Gerasimov reported a critical severity vulnerability within the advisory (CVE-2021-22005) that can be used to achieve command execution on an affected system. The vulnerability is deemed to be especially severe as it does not require authentication to exploit and provides access to the management functionality for an organisation’s virtualised network. Should a malicious actor gain access, they could have a significant impact on an organisation through the deployment of ransomware or theft of sensitive data.

Proof of Concept (PoC) code was publicly released for the vulnerability on the 28th of September, which can be used to spawn a remote shell on a targeted host. This puts any unpatched vCenter hosts at significant risk, with malicious actors confirmed to have been attempting to exploit the vulnerability at scale.

In addition to CVE-2021-22005, details of other high impact vulnerabilities were revealed within the advisory, which range from the disclosure of sensitive information to the elevation of privileges of an account compromised on the vCenter host. Due to the potential impact of the vulnerabilities (the majority of which have a CVSS over 6.5) and the likelihood that PoC code will be publicly available shortly, it is vital that the fixes described below are implemented immediately.

Attack surface management company Randori have released a technical article regarding several of the vulnerabilities detailed within the VMware security advisory. The article provides indicators of compromise for the vulnerabilities discussed, which should be reviewed and used to investigate vCenter hosts that were vulnerable at the time the security advisory was released for a potential breach.

The presence of vulnerabilities, such as those detailed in the VMware advisory, highlights the need for a defence in depth approach to security. While it is important to ensure that software is kept up to date with all security patches applied, this will only protect you from vulnerabilities that have been reported and fixed by the vendor.

Should a malicious actor already have access to your internal network, for example through compromising a user account via a phishing attack, it is vital that they are not able to exploit newly disclosed or unknown vulnerabilities within sensitive or mission critical infrastructure. To reduce this risk, such infrastructure should be segregated and not accessible from standard user workstations, with network access controls used to provide administrative users access to known and trusted systems.

 

How to fix the vulnerabilities

CVE-2021-22005 was fixed within vCenter Server 7.0 update 2c (released 24th August 2021). VMware has since released patches to fix all vulnerabilities present within the advisory on all supported versions of the platform and urges customers that run the affected software to install them immediately.

In addition, the vendor has released a workaround for the critical vulnerability detailed above for customers that are unable to update immediately. However, this workaround is seen as a last resort, used to provide organisations additional time until they are able to patch affected systems.

Resources

  • Insights
  • Labs

OWASP Top 10 2021 Released

The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP develop…

What is penetration testing and why is it important to use a CREST-approved provider?

Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration…

How secure use of the cloud can digitally transform your business

Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk to company assets. Businesses must keep up with growing customer…

How to prepare your business for secure cloud migration

The cloud holds a lot of potential for organisations. Moving your IT environment to the cloud provides flexibility and agility. It allows your team to…

Celebrating Sentrium’s contribution to cyber security

2020 is the year that remote working exploded. Businesses and the general public had to quickly adapt to new ways of working caused by the…

What is CREST and what are the benefits of using a CREST accredited company?

We’re delighted to announce that Sentrium Security is now a CREST accredited company! This is an exciting achievement for us and it’s great to be…

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

New Exchange RCE vulnerability actively exploited

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…

How effective is secure code review for discovering vulnerabilities?

We’ve recently discussed application security and the trend we’re seeing in which companies are increasingly implementing security early on in the Software Development Life Cycle…

Application Security (AppSec)

There is a movement in the IT security world that is gaining traction, and it is based around the implementation of security within applications from…

Enhancing Security in your Software Development LifeCycle – Dealing with Dependencies

The adoption of agile practices has resulted in the emergence of shift-lift testing, where testing is performed much earlier in the Software Development LifeCycle (SDLC).…

Exchange Server Emergency Mitigation Service

It has been a tough few months for Microsoft. After the SolarWinds/NOBELLIUM attacks, Microsoft Exchange customers were afflicted with a slew of vulnerabilities. In March…

TOP