vCenter vROps Plugin Unauthenticated Upload

aka vCenter uploadova RCE

Product: VMware vCenter Server
CVE: CVE-2021-21972
Disclosed: 2021-02-23
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: vCenter Server 6.5 before 6.5 U3n, 6.7 before 6.7 U3l, 7.0 before 7.0 U1c; Cloud Foundation 3.x before 3.10.1.2 and 4.x before 4.2.
Fixed: vCenter 6.5 U3n, 6.7 U3l, 7.0 U1c (VMSA-2021-0002).

Summary

The vRealize Operations plugin in the vCenter web client, enabled by default, exposed an unauthenticated file-upload endpoint. Attackers uploaded a crafted tar archive with path-traversal entries to drop a webshell or SSH key and take over vCenter.

Root cause

The /ui/vropspluginui/rest/services/uploadova endpoint lacked authentication and extracted uploaded TAR files without sanitizing entry names. Path-traversal entries are written anywhere the vsphere-ui user can write: e.g. /home/vsphere-ui/.ssh/authorized_keys or a JSP under h5ngc.war/resources on the appliance, or a JSP into the perfcharts statsreport webapp on Windows (runs as SYSTEM).

Impact

Unauthenticated RCE on vCenter, which gives control of every ESXi host and VM it manages.

Public PoC

# check only: script reports vulnerable when the GET returns 405
python3 CVE-2021-21972.py -t vcenter.lab

# exploit: tar the file with a ../ x5 traversal path and POST it to uploadova
python3 CVE-2021-21972.py -t vcenter.lab -f authorized_keys \
  -p /home/vsphere-ui/.ssh/authorized_keys -o unix

Source: horizon3ai - CVE-2021-21972

Detection

A GET to /ui/vropspluginui/rest/services/uploadova returning 405 means the endpoint is exposed (likely vulnerable). Nuclei template CVE-2021-21972; review vsphere-ui logs for POSTs to uploadova.

Mitigation

Upgrade per VMSA-2021-0002, or disable the vROps plugin by setting it to incompatible in compatibility-matrix.xml (VMware KB82374).