Published: 31/03/2021 Updated: 01/02/2022

CVSS v2 Base Score: 8.5 | Impact Score: 9.2 | Exploitability Score: 8

CVSS v3 Base Score: 6.5 | Impact Score: 5.2 | Exploitability Score: 1.2

VMScore: 891

Vector: AV:N/AC:L/Au:S/C:N/I:C/A:C

Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) before 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vmware vrealize operations manager 7.0.0
vmware vrealize operations manager 7.5.0
vmware vrealize operations manager 8.0.0
vmware vrealize operations manager 8.0.1
vmware vrealize operations manager 8.1.0
vmware vrealize operations manager 8.1.1
vmware vrealize operations manager 8.2.0
vmware vrealize operations manager 8.3.0
vmware cloud foundation 3.0
vmware cloud foundation 3.0.1
vmware cloud foundation 3.0.1.1
vmware cloud foundation 3.5
vmware cloud foundation 3.5.1
vmware cloud foundation 3.7
vmware cloud foundation 3.7.1
vmware cloud foundation 3.7.2
vmware cloud foundation 3.8
vmware cloud foundation 3.8.1
vmware cloud foundation 3.9
vmware cloud foundation 3.9.1
vmware cloud foundation 3.10
vmware cloud foundation 4.0
vmware cloud foundation 4.0.1
vmware vrealize suite lifecycle manager 8.0
vmware vrealize suite lifecycle manager 8.0.1
vmware vrealize suite lifecycle manager 8.1
vmware vrealize suite lifecycle manager 8.2

Sign up for Security Advisories Stay up to date on the latest VMware Security advisories and updates ...

This Metasploit module exploits a pre-auth server-side request forgery (CVE-2021-21975) and post-auth file write (CVE-2021-21983) in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the /casa/private/config/slice/ha/certifi ...

This module exploits a pre-auth SSRF (CVE-2021-21975) and post-auth file write (CVE-2021-21983) in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the /casa/private/config/slice/ha/ ...

This module exploits a pre-auth SSRF (CVE-2021-21975) and post-auth file write (CVE-2021-21983) in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload. CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the /casa/private/config/slice/ha/certificate endpoint. Code execution occurs as the "admin" Unix user. The following vRealize Operations Manager versions are vulnerable: * 7.0.0 * 7.5.0 * 8.0.0, 8.0.1 * 8.1.0, 8.1.1 * 8.2.0 * 8.3.0 Version 8.3.0 is not exploitable for creds and is therefore not supported by this module. Tested successfully against 8.0.1, 8.1.0, 8.1.1, and 8.2.0.

msf > use exploit/linux/http/vmware_vrops_mgr_ssrf_rce
msf exploit(vmware_vrops_mgr_ssrf_rce) > show targets
    ...targets...
msf exploit(vmware_vrops_mgr_ssrf_rce) > set TARGET < target-id >
msf exploit(vmware_vrops_mgr_ssrf_rce) > show options
    ...show and set options...
msf exploit(vmware_vrops_mgr_ssrf_rce) > exploit

[CVE-2021-21975] VMware vRealize Operations Manager API Server Side Request Forgery (SSRF)

[CVE-2021-21975] VMware vRealize Operations Manager API Server Side Request Forgery (SSRF) vRealize Operations (vROps) is a tool that self-driving IT operations management powered by AI from apps to infrastructure to optimize, plan and scale VMware Cloud and HCI deployments while unifying public cloud monitoring VMware vRealize Operations Manager API 84 and all previous vers

CVE-2021-21975 vRealize Operations Manager SSRF

Impacted Products VMware vRealize Operations 830、820、811、810、750 VMware Cloud Foundation 4x、3x vRealize Suite Lifecycle Manager 8x Description On March 31, 2021, VMware officially released the risk notice of vmsa-2021-0004 The vulnerability numbers are cve-2021-21975 and cve-2021-21983 The vulnerability level is high risk and the vulnerability score i

vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0DAY-?????)

REALITY_SMASHER vRealize RCE + Privesc (CVE-2021-21975, CVE-2021-21983, CVE-0DAY-?????) "As easy to stop as it is to comprehend" What is it? "Reality Smasher" is an exploit for vRealize leveraging the security issues addressed in VMSA-2021-0004 (CVE-2021-21975, CVE-2021-21983) in addition to a privilege escalation vulnerability discovered during testing Ho

[CVE-2021-21983] VMware vRealize Operations (vROps) Manager API Arbitrary File Write Leads to Remote Code Execution (RCE)

[CVE-2021-21975] VMware vRealize Operations (vROps) Manager API Arbitrary File Write Leads to Remote Code Execution (RCE) vRealize Operations (vROps) is a tool that self-driving IT operations management powered by AI from apps to infrastructure to optimize, plan and scale VMware Cloud and HCI deployments while unifying public cloud monitoring VMware vRealize Operations Manage

NVD-CWE-noinfo https://www.vmware.com/security/advisories/VMSA-2021-0004.html http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html https://nvd.nist.gov https://github.com/murataydemir/CVE-2021-21975 https://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html https://www.vmware.com/security/advisories/VMSA-2021-0004.html

CVE-2021-21983

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Metasploit Modules

Github Repositories

References

Vulmon Search

About

Products

Connect