Critical VMware Vulnerability CVE-2021-21985

THE THREAT

VMware has announced a new critical vulnerability impacting VMware vCenter Servers, tracked as CVE-2021-21985 (CVSS:9.8). VMware vCenter Servers using standard configurations that are exposed to the internet over port 443, are affected. Exploitation of CVE-2021-21985 may allow for Remote Code Execution (RCE) on the underlying operating system.

Due to the high severity of the vulnerability and the potential impact of exploitation, eSentire assesses that threat actors will exploit this vulnerability in the near future. Organizations are strongly recommended to apply the available security patches as soon as possible.

What we’re doing about it

• MVS will automatically add the relevant plugins for this vulnerability once details are made available
• eSentire security teams continue to track this vulnerability for additional information and detection measures

What you should do about it

• After performing a business impact review, apply the official security patches from VMware
  • If patching is not currently possible, apply the available workarounds recommended by VMware until patches can be deployed

Additional information

CVE-2021-21985 should be prioritized for patching as soon as possible. VMware vulnerabilities have been heavily exploited in the past by both financially motivated criminals and Nation-State APT groups. VMware announced a similar vulnerability in February 2021, and Proof-of-Concept (PoC) exploit code was publicly available within 24 hours of the release.

In addition to CVE-2021-21985, VMware has also announced a less critical authentication plugin vulnerability tracked as CVE-2021-21986 (CVSS: 6.5).

Vulnerability Details:

• CVE-2021-21985: VMware vCenter Server Remote Code Execution Vulnerability in the vSphere Client
• CVE-2021-21986: Authentication Mechanism Vulnerability in vCenter Server Plug-ins

Impacted Products:

• VCenter Server v. 7.0
• VCenter Server v. 6.7
• VCenter Server v. 6.5
• Cloud Foundation (vCenter Server) v. 4.x
• Cloud Foundation (vCenter Server) v. 3.x

References:

[1] https://www.vmware.com/security/advisories/VMSA-2021-0010.html
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21985
[3] https://kb.vmware.com/s/article/83829
[4] https://www.esentire.com/security-advisories/vmware-remote-code-execution-vulnerability