A Critical Security Flaw Found on all VMware vCenter Servers

PUBLISHED:
28 May 2021

A Critical Security Flaw Found on all VMware vCenter Servers

A critical  remote code execution bug was found in VMware vCenter Server 6.5, 6.7, and 7.0, according to VMware’s security advisory. The vulnerability rated with a CVSSv3 base score of 9.8 out of 10 is being tracked as CVE-2021-21985.

The issue exists on the vSphere Client (HTML5) of Virtual SAN Health Check plug-in which is enabled by default in all vCenter Server deployments, whether or not vSAN is being used. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

VMware further stated that in this era of ransomware, it is safest to assume that an attacker is already inside the network somewhere, on a desktop, and perhaps even in control of a user account, which is why VMware strongly recommends declaring an emergency change and patching as soon as possible.

Affected Versions

• vCenter Server 6.5
• vCenter Server 6.7
• vCenter Server 7.0
• Cloud Foundation (vCenter Server)  4.x
• Cloud Foundation (vCenter Server)  3.x

Mitigation

Apply the security updates or apply the workaround described in VMSA-2021-0010.

More Information

• VMSA-2021-0010 – https://www.vmware.com/security/advisories/VMSA-2021-0010.html
• CVE-2021-21985 – https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21985