VMware has released patches for two security flaws in vCenter Server and Cloud Foundation that a remote attacker might exploit to obtain access to sensitive data. An arbitrary file read vulnerability in the vSphere Web Client is the most serious of the flaws. The flaw, CVE-2021-21980, has been assigned a CVSS score of 7.5 out of ten, and it affects vCenter Server versions 6.5 and 6.7.
The firm warned in an alert released on November 23 that a hostile actor having network access to vCenter Server’s port 443 might exploit the problem to obtain access to sensitive information, citing ch0wn of Orz lab for reporting the flaw.
“The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information,” VMware warned.
The second flaw addressed by VMware is an SSRF (Server-Side Request Forgery) weakness in the vSAN Web Client plug-in, which could allow a cybercriminal with network access to port 443 on vCenter Server to exploit the flaw by accessing an internal service or making a URL request from outside the Server.
SSRF attacks are a type of web security flaw that allows an attacker to read or alter internal resources that the target server has access to by sending specially crafted HTTP requests, resulting in unauthorized information disclosure. SSRF attacks pose such a significant and broad threat that they were included in the Open Web Application Security Project’s (OWASP) Top 10 web application security concerns for 2021.
Because VMware’s virtualization technologies are so extensively utilized in businesses, it’s no wonder that threat actors have turned to its products to launch a range of assaults against susceptible networks. It is suggested that organizations implement the essential upgrades as soon as possible to reduce the danger of infiltration.
