{"id":7504,"date":"2021-09-27T19:40:03","date_gmt":"2021-09-28T02:40:03","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7504"},"modified":"2023-04-05T12:38:00","modified_gmt":"2023-04-05T19:38:00","slug":"critical-vmware-vulnerability-patch-cve-2021-22005-now","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/critical-vmware-vulnerability-patch-cve-2021-22005-now\/","title":{"rendered":"Critical VMware Vulnerability: Patch CVE-2021-22005 Now!"},"content":{"rendered":"

{Updated on October 07, 2021}:<\/strong> A full working redacted Proof of Concept<\/a> was released by an independent researcher, William Vu, on September 28, 2021. Within a few hours of the release of the proof of concept, cybercriminals were observed using the unredacted proof-of-concept in active exploits.<\/p>\n

The proof of concept is separate from the partial POC released by Jang. This version can allow remote attackers to execute arbitrary code by using a reverse shell on a vulnerable server. The vulnerability can then be exploited by unauthenticated users remotely and allow attackers to upload a specially-crafted file to the vCenter Server Analytics Service. Since the patch<\/a> to the critical vulnerability is already available, we recommend urgent patching of servers.<\/p>\n

We urge organizations to continuously update all their enterprise assets so as not to be at risk of a ransomware attack.<\/p>\n

\"VMware<\/p>\n

On September 21, 2021, VMware published an advisory<\/a> warning of nineteen vulnerabilities in their vCenter Server. <\/strong>Of the nineteen vulnerabilities, one CVE stands out as being extremely critical and potential to be exploited by ransomware\u2014CVE-2021-22005.<\/strong><\/p>\n

Researchers at Cyber Security Works (CSW) analyzed these vulnerabilities from a Pentester\u2019s perspective and here is their verdict.<\/p>\n

\n

“Any malicious actor who has network access to port 443 on vCenter Server can exploit CVE-2021-22005 easily and execute code by uploading a maliciously crafted file.”<\/strong>
\n~ A Pentester\u2019s Perspective<\/p>\n<\/blockquote>\n