Arbitrary file upload in vCenter Server - CVE-2021-22005
Published: September 21, 2021 / Updated: March 14, 2022
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload within the Analytics service. A remote non-authenticated attacker with network access to port 443/TCP can upload and execute arbitrary file on the server.
Successful exploitation of the vulnerability may results in full compromise of the affected system.
Note, we are aware of the vulnerability being exploited in the wild as of September 23.
Affected software
Dell Enterprise Hybrid Cloud
EMC Integrated Data Protection Appliance
Dell EMC VxRail Appliance
How to mitigate CVE-2021-22005
Install updates from vendor's website.
Note, the vulnerability affects any version of vCenter Server 7.0 and vCenter Server 6.7 running on Virtual Appliance (e.g. vCenter Server 6.7 running on Windows is not affected).
EMC Integrated Data Protection Appliance - update to 2.7.0
Dell Enterprise Hybrid Cloud - update to 4.1.2
Dell EMC VxRail Appliance - addressed in versions 4.5.463, 4.7.536, 7.0.241
Links to Public Exploits and PoC-codes
- Exploit #7484 - CVE-2021-22005poc (CVE-2021-22005 vcenter任意文件上传批量验证poc) (March 14, 2022)
- Exploit #7385 - CVE-2021-22005 () (February 23, 2022)
- Exploit #7197 - cve-2021-22005-exp () (December 22, 2021)
- Exploit #6948 - CVE-2021-22005 (VMware vCenter Server任意文件上传漏洞 / Code By:Jun_sheng) (October 27, 2021)
- Exploit #6938 - CVE-2021-22005 () (October 26, 2021)
- Exploit #6844 - VMware vCenter Server Analytics (CEIP) Service File Upload (October 7, 2021)
- Exploit #6813 - CVE-2021-22005-metasploit (the metasploit script(POC/EXP) about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability) (October 3, 2021)
- Exploit #6807 - CVE-2021-22005 () (September 30, 2021)
- Exploit #6800 - exp_hub (漏洞复现与poc收集，CVE-2021-21975，cve-2021-22005，CVE-2021-26295，VMware vCenter任意文件读取) (September 29, 2021)
- Exploit #6794 - CVE-2021-22005 (CVE-2021-22005 - VMWare vCenter Server File Upload to RCE) (September 27, 2021)
- Exploit #6793 - CVE-2021-22005- (CVE-2021-22005批量验证python脚本) (September 25, 2021)
- Exploit #6786 - VMWare-CVE-Check (CVE-2021-22005) (September 23, 2021)
- Exploit #6784 - CVE-2021-22005 () (September 23, 2021)