CVE-2021-22008 : Security Advisory and Response

This article provides insights into CVE-2021-22008, an information disclosure vulnerability found in VMware vCenter Server and VMware Cloud Foundation.

Understanding CVE-2021-22008

CVE-2021-22008 is a security vulnerability discovered in the VAPI (vCenter API) service of vCenter Server. It allows a malicious actor with network access to potentially access sensitive information by sending a specially crafted json-rpc message.

What is CVE-2021-22008?

The vulnerability in the vCenter Server's VAPI service enables unauthorized access to sensitive data by exploiting a flaw that resides in processing specific json-rpc messages sent to the server over port 443.

The Impact of CVE-2021-22008

The exploitation of this vulnerability poses a significant risk as it could lead to an attacker gaining unauthorized access to confidential information stored on the vCenter Server and VMware Cloud Foundation instances.

Technical Details of CVE-2021-22008

CVE ID: CVE-2021-22008 Vendor: VMware Affected Versions: VMware vCenter Server (7.x before 7.0 U2c, 6.7 before 6.7 U3o, 6.5 before 6.5 U3q) and VMware Cloud Foundation (4.x before 4.3, 3.x before 3.10.2.2)

Vulnerability Description

The vulnerability allows a remote attacker to send malicious json-rpc messages to the vCenter Server via port 443, potentially leading to an information disclosure risk.

Affected Systems and Versions

VMware vCenter Server versions 7.x (before 7.0 U2c), 6.7 (before 6.7 U3o), 6.5 (before 6.5 U3q), and VMware Cloud Foundation versions 4.x (before 4.3) and 3.x (before 3.10.2.2) are impacted by this vulnerability.

Exploitation Mechanism

An attacker can gain unauthorized access to sensitive information by exploiting the flaw in the VAPI service, allowing them to send crafted json-rpc messages to the server over port 443.

Mitigation and Prevention

It is crucial for organizations to take immediate steps to address and prevent the exploitation of CVE-2021-22008.

Immediate Steps to Take

Apply security patches provided by VMware to remediate the vulnerability.
Restrict network access to the vCenter Server to authorized users only.

Long-Term Security Practices

Regularly update and apply security patches to all software and systems.
Implement network segmentation and access controls to minimize the attack surface.

Patching and Updates

Ensure that you keep your VMware vCenter Server and VMware Cloud Foundation instances up to date with the latest security patches from the vendor.