VMware has issued patches for a critical remote code execution vulnerability in vCenter Server. Organizations are strongly encouraged to apply patches as soon as possible. Update June 2: The Identifying Affected Systems section has been updated to include audit checks for the workaround. Update June 4: The Proof of Concept section has been updated to reflect the publication of exploit code and active scanning for vulnerable servers.

CVE-2021-21985: Critical VMware vCenter Server Remote Code Execution

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U2b, 6.7 before 6.7 U3n, and 6.5 before 6.5 U3p) and VMware Cloud Foundation (4.x before 4.2.1 and 3.x before 3.10.2.1).

The version of VMware vCenter Server installed on the remote host is 6.5 prior to 6.5 U3p, 6.7 prior to 6.7 U3n or 7.0 prior to 7.0 U2b. It is, therefore, affected by multiple vulnerabilities:

  - The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the     Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network     access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying     operating system that hosts vCenter Server. (CVE-2021-21985)

  - The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN     Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A     malicious actor with network access to port 443 on vCenter Server may perform actions allowed by the impacted     plug-ins without authentication. (CVE-2021-21986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number. Nessus has also not tested for the presence of a workaround.

ID	Name	Product	Family	Severity
113244	VMWare vCenter Server 6.5 < 6.5 U3p / 6.7 < 6.7 U3n / 7.0 < 7.0 U2b Remote Code Execution	Web App Scanning	Component Vulnerability	critical
150163	VMware vCenter Server Virtual SAN Health Check plug-in RCE (CVE-2021-21985) (direct check)	Nessus	Misc.	critical
149902	VMware vCenter Server 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2021-0010)	Nessus	Misc.	critical

Detections

Analytics

CVE-2021-21985

critical

Tenable Plugins

critical

critical

critical