VMware informs its customers to urgently patch a sensitive arbitrary file upload vulnerability in the Analytics service, affecting all the tools running default vCenter Server 6.7 and 7.0 setup. vCenter Server is a server management solution that helps IT admin handle virtualized hosts and virtual machines in operation environments through a single console. “Such vulnerabilities can be utilized by anyone who can influence vCenter Server over the network to gain access, disregarding of the configuration setting of vCenter Server,” said Bob Plankers, who is a Technical Marketing Architect at VMware.

“In this stage of ransomware it is safest to consider that a threat actor is already inside the network somewhere, on a desktop and possibly even in control of a user account, which is why we actively suggest declaring an emergency change and patching as soon as potential.”

Sensitive Flaw with an Almost Perfect Harshness Score

The security flaw — tracked as CVE-2021-22005 and with a CVSS 3.1 severity rating of 9.8/10 — can be exploited by attackers to execute commands and software on unpatched vCenter Server deployments by uploading a specially crafted file. This bug was reported by George Noseevich and Sergey Gerasimov of SolidLab LLC, and it can be exploited by unauthenticated attackers remotely in low complexity attacks that don’t require user interaction.

“The vCenter Server accommodates an arbitrary file upload vulnerability in the Analytics service,” VMware explains in the security advisory. “A malicious actor with network access to port 443 on vCenter Server may abuse this issue to execute code on vCenter Server by uploading a specifically crafted file.”

As per the company, patching this vulnerability should be added to the top of any IT admin’s task list, given that working exploits will likely surface right after the bug’s disclosure. “Immediately, the consequences of this vulnerability are serious and it is a resolution of time – likely minutes after the exposure – before working exploits are publicly available,” VMware said.

“With the threat of ransomware appearing nowadays the most reliable stance is to assume that an attacker may already have control of a desktop and a user account through the use of techniques like phishing or spearphishing, and act accordingly. “This means the attacker may previously be able to lead vCenter Server from inside a corporate firewall, and experience is of the essence.”  

Workaround Also Accessible

VMware further facilitates a workaround for those who cannot immediately patch their tools as a provisional resolution. The steps detailed need you to edit a text file on the virtual appliance and restarting services manually or using a VMware-provided script to remove the possibility of exploitation.

In May, VMware issued a similar warning respecting a sensitive remote code execution (RCE) error in the Virtual SAN Health Check plug-in impacting all vCenter Server set up. The other sensitive RCE bug impacting all vCenter Server set up running a vulnerable vCenter Server plug-in for vRealize Operations (vROps) present in all default installations was fixed in February.