server configuration command lines on a monitor

VMware vCenter Critical RCE Vulnerability

Tim

29th September 2021

4 min read

Last week, VMware released a security advisory that contained information regarding several high severity vulnerabilities, which are present within all currently supported versions of the VMware vCenter Server virtualisation management software.

Security researchers George Noseevich and Sergey Gerasimov reported a critical severity vulnerability within the advisory (CVE-2021-22005) that can be used to achieve command execution on an affected system. The vulnerability is deemed to be especially severe as it does not require authentication to exploit and provides access to the management functionality for an organisation’s virtualised network. Should a malicious actor gain access, they could have a significant impact on an organisation through the deployment of ransomware or theft of sensitive data.

Proof of Concept (PoC) code was publicly released for the vulnerability on the 28th of September, which can be used to spawn a remote shell on a targeted host. This puts any unpatched VMware vCenter hosts at significant risk, with malicious actors confirmed to have been attempting to exploit the vulnerability at scale.

In addition to CVE-2021-22005, details of other high impact vulnerabilities were revealed within the advisory, which range from the disclosure of sensitive information to the elevation of privileges of an account compromised on the vCenter host. Due to the potential impact of the vulnerabilities (the majority of which have a CVSS over 6.5) and the likelihood that PoC code will be publicly available shortly, it is vital that the fixes described below are implemented immediately.

Attack surface management company Randori have released a technical article regarding several of the vulnerabilities detailed within the VMware security advisory. The article provides indicators of compromise for the vulnerabilities discussed, which should be reviewed and used to investigate vCenter hosts that were vulnerable at the time the security advisory was released for a potential breach.

The presence of vulnerabilities, such as those detailed in the VMware advisory, highlights the need for a defence in depth approach to security. While it is important to ensure that software is kept up to date with all security patches applied, this will only protect you from vulnerabilities that have been reported and fixed by the vendor.

Should a malicious actor already have access to your internal network, for example through compromising a user account via a phishing attack, it is vital that they are not able to exploit newly disclosed or unknown vulnerabilities within sensitive or mission critical infrastructure. To reduce this risk, such infrastructure should be segregated and not accessible from standard user workstations, with network access controls used to provide administrative users access to known and trusted systems.

 

How to fix the vulnerabilities

CVE-2021-22005 was fixed within vCenter Server 7.0 update 2c (released 24th August 2021). VMware has since released patches to fix all vulnerabilities present within the advisory on all supported versions of the platform and urges customers that run the affected software to install them immediately.

In addition, the vendor has released a workaround for the critical vulnerability detailed above for customers that are unable to update immediately. However, this workaround is seen as a last resort, used to provide organisations additional time until they are able to patch affected systems.

Sentrium can assist with your security needs, view our penetration testing services for more details or contact us today.

Resources

  • Insights
  • Labs
The importance of a post-penetration test action plan

The importance of a post-penetration test action plan

As cyber threats continue to evolve and become more sophisticated, businesses must stay one step ahead in protecting their sensitive data and network infrastructure. Penetration…

How to choose the right penetration testing partner

How to choose the right penetration testing partner for your business

In today’s digital landscape, cybersecurity threats are evolving at an alarming rate. With the growing number of cyber-attacks and data breaches, businesses must prioritise their…

IoT device security, penetration testing

Securing the Internet of Things: Penetration testing’s role in IoT device security

The world is witnessing a remarkable transformation as more devices become interconnected, forming what’s known as the Internet of Things (IoT). From smart refrigerators and…

Man working as a junior penetration tester

My first month working as a junior penetration tester

Entering the world of cyber security as a junior penetration tester has been an eye-opening experience for me. In my first month, I’ve encountered challenges,…

The role of penetration testing in cybersecurity

The role of penetration testing in cybersecurity

Cybersecurity forms the backbone of safeguarding your business’s data. With cybercrime becoming more sophisticated, traditional security measures are often insufficient. Staying vigilant and proactive is…

IoT Devices

Internet of Things (IoT) Cyber Security

IoT Devices Internet of Things (IoT) cyber security is a growing problem and IoT devices can be found in almost every environment. In 2022 the…

Password cracking: How to crack a password

An introduction to password security: How to crack a password

Online Password Cracking An online attack is performed in real-time, against live services or applications to compromise active user accounts. Such attacks typically occur when…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…