Vulnerability Checks of VMWare vCenter Remote File Upload (CVE-2021-22005) | Cybersecurity Blog | Grey Noise

Summary: On September 21, 2021, VMware published an advisory for several vulnerabilities, most notably CVE-2021-22005, an arbitrary file upload flaw in vCenter Server that can lead to remote code execution regardless of the product's configuration settings. As of September 23, 2021, no public proof-of-concept code enabling arbitrary file upload or RCE was known, but GreyNoise observed a significant number of checks for vulnerable vCenter instances based on VMware's automated patching script, most egressing via Tor.
Why it matters: Attackers were scanning for unpatched vCenter servers through Tor before any public exploit existed, which means the window between disclosure and exploitation was already closing while defenders still had no PoC to test against.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-22005
Related: CVE-2021-22005: VMware vCenter Server File Upload Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Threat Source newsletter (Sept. 30, 2021) Cyber Risks ·
Malicious Tag Roundup (Sep 14-30, 2021) | Cybersecurity Blog | Grey Noise Cyber Risks ·