{"id":3226,"date":"2021-09-22T16:51:49","date_gmt":"2021-09-22T11:21:49","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=3226"},"modified":"2021-09-22T16:51:50","modified_gmt":"2021-09-22T11:21:50","slug":"vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/","title":{"rendered":"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs"},"content":{"rendered":"\n<p>VMware informs its customers to urgently patch a sensitive arbitrary file upload vulnerability in the Analytics service, affecting all the tools running default vCenter Server 6.7 and 7.0 setup. vCenter Server is a server management solution that helps IT admin handle virtualized hosts and virtual machines in operation environments through a single console. \u201cSuch vulnerabilities can be utilized by anyone who can influence vCenter Server over the network to gain access, disregarding of the configuration setting of vCenter Server,\u201d said Bob Plankers, who is a Technical Marketing Architect at VMware.<\/p>\n\n\n\n<p>\u201cIn this stage of ransomware it is safest to consider that a threat actor is already inside the network somewhere, on a desktop and possibly even in control of a user account, which is why we actively suggest declaring an emergency change and patching as soon as potential.\u201d<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Sensitive Flaw with an Almost Perfect Harshness Score<\/strong><\/h2>\n\n\n\n<p>The security flaw \u2014 tracked as CVE-2021-22005 and with a CVSS 3.1 severity rating of 9.8\/10 \u2014 can be exploited by attackers to execute commands and software on unpatched vCenter Server deployments by uploading a specially crafted file. This bug was reported by George Noseevich and Sergey Gerasimov of SolidLab LLC, and it can be exploited by unauthenticated attackers remotely in low complexity attacks that don&#8217;t require user interaction.<\/p>\n\n\n\n<p>&#8220;The vCenter Server accommodates an arbitrary file upload vulnerability in the Analytics service,&#8221; VMware explains in the security advisory. &#8220;A malicious actor with network access to port 443 on vCenter Server may abuse this issue to execute code on vCenter Server by uploading a specifically crafted file.&#8221;<\/p>\n\n\n\n<p>As per the company, patching this vulnerability should be added to the top of any IT admin&#8217;s task list, given that working exploits will likely surface right after the bug&#8217;s disclosure. &#8220;Immediately, the consequences of this vulnerability are serious and it is a resolution of time \u2013 likely minutes after the exposure \u2013 before working exploits are publicly available,&#8221; VMware said.<\/p>\n\n\n\n<p>&#8220;With the threat of ransomware appearing nowadays the most reliable stance is to assume that an attacker may already have control of a desktop and a user account through the use of techniques like phishing or spearphishing, and act accordingly. &#8220;This means the attacker may previously be able to lead vCenter Server from inside a corporate firewall, and experience is of the essence.&#8221;\u00a0\u00a0<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/VMware-Alerts-of-Sensitive-Flaw-in-Default-vCenter-Server-Installs-image1-1024x575.jpg\" alt=\"VMware-Alerts-of-Sensitive-Flaw-in-Default-vCenter-Server-Installs-image1\" class=\"wp-image-3229\" width=\"577\" height=\"323\" srcset=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/VMware-Alerts-of-Sensitive-Flaw-in-Default-vCenter-Server-Installs-image1-1024x575.jpg 1024w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/VMware-Alerts-of-Sensitive-Flaw-in-Default-vCenter-Server-Installs-image1-300x169.jpg 300w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/VMware-Alerts-of-Sensitive-Flaw-in-Default-vCenter-Server-Installs-image1-768x431.jpg 768w, https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/VMware-Alerts-of-Sensitive-Flaw-in-Default-vCenter-Server-Installs-image1.jpg 1200w\" sizes=\"(max-width: 577px) 100vw, 577px\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Workaround Also Accessible<\/strong><\/h2>\n\n\n\n<p>VMware further facilitates a workaround for those who cannot immediately patch their tools as a provisional resolution. The steps detailed need you to edit a text file on the virtual appliance and restarting services manually or using a VMware-provided script to remove the possibility of exploitation.<\/p>\n\n\n\n<p>In May, VMware issued a similar warning respecting a sensitive remote code execution (RCE) error in the Virtual SAN Health Check plug-in impacting all vCenter Server set up. The other sensitive RCE bug impacting all vCenter Server set up running a vulnerable vCenter Server plug-in for vRealize Operations (vROps) present in all default installations was fixed in February.&nbsp; &nbsp; &nbsp;&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>VMware informs its customers to urgently patch a sensitive arbitrary file upload vulnerability in the Analytics service, affecting all the tools running default vCenter Server 6.7 and 7.0 setup. vCenter Server is a server management solution that helps IT admin handle virtualized hosts and virtual machines in operation environments through a single console. \u201cSuch vulnerabilities [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":3228,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.11 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>VMware Alerts of Sensitive Flaw in Default vCenter Server Installs - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"VMware informs its customers to urgently patch a sensitive arbitrary file upload vulnerability in the Analytics service, affecting all the tools running default vCenter Server 6.7 and 7.0 setup. vCenter Server is a server management solution that helps IT admin handle virtualized hosts and virtual machines in operation environments through a single console. \u201cSuch vulnerabilities [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-22T11:21:49+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-22T11:21:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/VMware-Alerts-of-Sensitive-Flaw-in-Default-vCenter-Server-Installs-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs\",\"datePublished\":\"2021-09-22T11:21:49+00:00\",\"dateModified\":\"2021-09-22T11:21:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/\"},\"wordCount\":499,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/\",\"url\":\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/\",\"name\":\"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-09-22T11:21:49+00:00\",\"dateModified\":\"2021-09-22T11:21:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/","og_locale":"en_US","og_type":"article","og_title":"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs - Xiarch Solutions Private Limited","og_description":"VMware informs its customers to urgently patch a sensitive arbitrary file upload vulnerability in the Analytics service, affecting all the tools running default vCenter Server 6.7 and 7.0 setup. vCenter Server is a server management solution that helps IT admin handle virtualized hosts and virtual machines in operation environments through a single console. \u201cSuch vulnerabilities [&hellip;]","og_url":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-09-22T11:21:49+00:00","article_modified_time":"2021-09-22T11:21:50+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/09\/VMware-Alerts-of-Sensitive-Flaw-in-Default-vCenter-Server-Installs-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs","datePublished":"2021-09-22T11:21:49+00:00","dateModified":"2021-09-22T11:21:50+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/"},"wordCount":499,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/","url":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/","name":"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-09-22T11:21:49+00:00","dateModified":"2021-09-22T11:21:50+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/vmware-alerts-of-sensitive-flaw-in-default-vcenter-server-installs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"VMware Alerts of Sensitive Flaw in Default vCenter Server Installs"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3226"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=3226"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3226\/revisions"}],"predecessor-version":[{"id":3230,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3226\/revisions\/3230"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/3228"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=3226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=3226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=3226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}