Published: 31/03/2021 Updated: 01/02/2022

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 544

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) before 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vmware vrealize operations manager 7.0.0
vmware vrealize operations manager 7.5.0
vmware vrealize operations manager 8.0.0
vmware vrealize operations manager 8.0.1
vmware vrealize operations manager 8.1.0
vmware vrealize operations manager 8.1.1
vmware vrealize operations manager 8.2.0
vmware vrealize operations manager 8.3.0
vmware cloud foundation 3.0
vmware cloud foundation 3.0.1
vmware cloud foundation 3.0.1.1
vmware cloud foundation 3.5
vmware cloud foundation 3.5.1
vmware cloud foundation 3.7
vmware cloud foundation 3.7.1
vmware cloud foundation 3.7.2
vmware cloud foundation 3.8
vmware cloud foundation 3.8.1
vmware cloud foundation 3.9
vmware cloud foundation 3.9.1
vmware cloud foundation 3.10
vmware cloud foundation 4.0
vmware cloud foundation 4.0.1
vmware vrealize suite lifecycle manager 8.0
vmware vrealize suite lifecycle manager 8.0.1
vmware vrealize suite lifecycle manager 8.1
vmware vrealize suite lifecycle manager 8.2

Sign up for Security Advisories Stay up to date on the latest VMware Security advisories and updates ...

This Metasploit module exploits a pre-auth server-side request forgery (CVE-2021-21975) and post-auth file write (CVE-2021-21983) in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the /casa/private/config/slice/ha/certifi ...

This module exploits a pre-auth SSRF (CVE-2021-21975) and post-auth file write (CVE-2021-21983) in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the /casa/private/config/slice/ha/ ...

This module exploits a pre-auth SSRF (CVE-2021-21975) and post-auth file write (CVE-2021-21983) in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload. CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the /casa/private/config/slice/ha/certificate endpoint. Code execution occurs as the "admin" Unix user. The following vRealize Operations Manager versions are vulnerable: * 7.0.0 * 7.5.0 * 8.0.0, 8.0.1 * 8.1.0, 8.1.1 * 8.2.0 * 8.3.0 Version 8.3.0 is not exploitable for creds and is therefore not supported by this module. Tested successfully against 8.0.1, 8.1.0, 8.1.1, and 8.2.0.

msf > use exploit/linux/http/vmware_vrops_mgr_ssrf_rce
msf exploit(vmware_vrops_mgr_ssrf_rce) > show targets
    ...targets...
msf exploit(vmware_vrops_mgr_ssrf_rce) > set TARGET < target-id >
msf exploit(vmware_vrops_mgr_ssrf_rce) > show options
    ...show and set options...
msf exploit(vmware_vrops_mgr_ssrf_rce) > exploit

[CVE-2021-21975] VMware vRealize Operations Manager API Server Side Request Forgery (SSRF)

[CVE-2021-21975] VMware vRealize Operations Manager API Server Side Request Forgery (SSRF) vRealize Operations (vROps) is a tool that self-driving IT operations management powered by AI from apps to infrastructure to optimize, plan and scale VMware Cloud and HCI deployments while unifying public cloud monitoring VMware vRealize Operations Manager API 84 and all previous vers

VMware Vulnerabilites VMware vCenter unauthorized arbitrary file read PoC working to Earlier versions (70200100) Shodan Query for Private members only PoC CVE-2021-21972 PoC | VMware Unauthorized RCE CVE-2021-21972 PoC vmware ssrf poc | cve-2021-21975 poc cve-2021-21975 poc cve-2021-22005 poc | Vmware RCE cve-2021-22005 poc Follow us Vulnmachines YouTube Twitter Facebook Li

CVE-2021-21975 vRealize Operations Manager SSRF

Impacted Products VMware vRealize Operations 830、820、811、810、750 VMware Cloud Foundation 4x、3x vRealize Suite Lifecycle Manager 8x Description On March 31, 2021, VMware officially released the risk notice of vmsa-2021-0004 The vulnerability numbers are cve-2021-21975 and cve-2021-21983 The vulnerability level is high risk and the vulnerability score i

漏洞复现与poc收集，CVE-2021-21975，cve-2021-22005，CVE-2021-26295，VMware vCenter任意文件读取

0x01 注该项目仅供合法的渗透测试以及爱好者参考学习，请各位遵守《中华人民共和国网络安全法》以及相应地方的法律，禁止使用该项目进行违法操作，否则自行承担相关责任！ 0x02 VMware CVE-2021-21975 VMware vRealize Operations Manager SSRF漏洞 vCenter任意文件读取 VMware vCenter任意文件读取漏洞 vCe

vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0DAY-?????)

REALITY_SMASHER vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0DAY-?????) "As easy to stop as it is to comprehend" What is it? "Reality Smasher" is an exploit for vRealize leveraging the security issues addressed in VMSA-2021-0004 (CVE-2021-21975, CVE-2021-21983) in addition to a privilege escalation vulnerability discovered during testing Ho

[CVE-2021-21983] VMware vRealize Operations (vROps) Manager API Arbitrary File Write Leads to Remote Code Execution (RCE)

[CVE-2021-21975] VMware vRealize Operations (vROps) Manager API Arbitrary File Write Leads to Remote Code Execution (RCE) vRealize Operations (vROps) is a tool that self-driving IT operations management powered by AI from apps to infrastructure to optimize, plan and scale VMware Cloud and HCI deployments while unifying public cloud monitoring VMware vRealize Operations Manage

Config files for my GitHub profile.

CVE-2021-21975 poc

CVE-2021-21975 #SSRF-POC - ssrf to cred leak #First configure pd client #Now run /pd deploy http-new-requests #now replace the pipedream http request ex: Randomstringmpipedreamnet in the script #run this in a seperate terminal - /pd logs new-requests | tee -a reqtxt #and now run this in another terminal - python3 CVE-2021-21975py iplist #cat reqtxt | grep Basic &g

VMWare vRealize SSRF-CVE-2021-21975

VMWare-vRealize-SSRF VMWare vRealize SSRF-CVE-2021-21975 #USE python CVE-2021-21975py

VMWare-CVE-2021-21975 SSRF vulnerability

VMWare-CVE-2021-21975 VMWare-CVE-2021-21975 SSRF vulnerability Youtube PoC wwwyoutubecom/watch?v=faeTl8ZPs2s Follow Youtube Twitter Telegram Vulnmachinescom

Nmap script to check vulnerability CVE-2021-21975

CVE-2021-21975 Nmap script to check vulnerability CVE-2021-21975 Vulnerability References: apphowlermonkeyio/vulnerabilities/CVE-2021-21975 wwwvmwarecom/security/advisories/VMSA-2021-0004html Blog wwwguayoyoio/post/cve-2021-21975-vmware-vrealize-operations-manager-ssrf-lo-que-necesitas-saber Example nmap -p443 --script cve-2021-21975nse --script-

Nmap script to check vulnerability CVE-2021-21975

CVE-2021-21975 Nmap script to check vulnerability CVE-2021-21975 Vulnerability References: apphowlermonkeyio/vulnerabilities/CVE-2021-21975 wwwvmwarecom/security/advisories/VMSA-2021-0004html Blog wwwguayoyoio/post/cve-2021-21975-vmware-vrealize-operations-manager-ssrf-lo-que-necesitas-saber Example nmap -p443 --script cve-2021-21975nse --script-

CVE2021-21975 VMware vRealize SSRF Exploit Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 84 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials Installation git clone githubcom/CyberCommands/CVE2021-2197

CWE-918 https://www.vmware.com/security/advisories/VMSA-2021-0004.html http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html https://nvd.nist.gov https://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html https://github.com/murataydemir/CVE-2021-21975 https://www.vmware.com/security/advisories/VMSA-2021-0004.html

CVE-2021-21975

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Metasploit Modules

Github Repositories

References

Vulmon Search

About

Products

Connect