{
  "Name": "VMware vCenter rce (CVE-2021-22017)",
  "Description": "<p>VMware vCenter Server is a set of server and virtualization management software from Vmware. The software provides a centralized platform for managing VMware vSphere environments, which can automatically implement and deliver virtual infrastructure.</p><p>Due to improper implementation of URI standardization, an rhttpproxy bypass vulnerability exists in VMware vCenter Server. Attackers can use this vulnerability to gain unauthorized access to some specific interfaces, and then use Velocity template engine to render malicious templates to modify log files, resulting in arbitrary code execution ( CVE-2021-22017).</p>",
  "Product": "Vmware VCenter",
  "Homepage": "https://www.vmware.com/products/vcenter-server.html",
  "DisclosureDate": "2021-09-27",
  "Author": "keeeee",
  "FofaQuery": "app=\"vmware-VirtualCenter\"||app=\"VMware-VirtualCenter\"",
  "Level": "3",
  "Impact": "<p>Due to improper implementation of URI standardization, an rhttpproxy bypass vulnerability exists in VMware vCenter Server. Attackers can use this vulnerability to gain unauthorized access to some specific interfaces, and then use Velocity template engine to render malicious templates to modify log files, resulting in arbitrary code execution ( CVE-2021-22017).</p>",
  "Recommandation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://www.vmware.com/security/advisories/VMSA-2021-0020.html\">https://www.vmware.com/security/advisories/VMSA-2021-0020.html</a><br></p>",
  "References": [
    "https://kb.vmware.com/s/article/85717",
    "https://testbnull.medium.com/quick-note-of-vcenter-rce-cve-2021-22005-4337d5a817ee"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "name": "AttackType",
      "type": "select",
      "value": "cmd,GetShell,Behinder_webshell"
    },
    {
      "name": "cmd",
      "type": "input",
      "value": "whoami",
      "show": "AttackType=cmd"
    },
    {
      "name": "passwd",
      "type": "input",
      "value": "vulgo",
      "show": "AttackType=GetShell"
    },
    {
      "name": "password",
      "type": "input",
      "value": "rebeyond",
      "show": "AttackType=Behinder_webshell"
    }
  ],
  "ExpTips": null,
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "method": "GET",
        "uri": "/test.php",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$body",
            "operation": "contains",
            "value": "test",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "ExploitSteps": [
    "AND",
    {
      "Request": {
        "method": "GET",
        "uri": "/test.php",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          },
          {
            "type": "item",
            "variable": "$body",
            "operation": "contains",
            "value": "test",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "Tags": [
    "rce"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": [
      "Vmware VCenter"
    ],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "VulType": [
    "rce"
  ],
  "CVE": "CVE-2021-22017",
   "CVEIDs": [
    "CVE-2021-22017"
  ]
}