Tag

vcenter

Browsing
Wallarm — vcenter
In Researcher Corner

Web vulnerabilities exploit weekly digest #1. March 8-15th 2021. VMware vCenter and Apache OFBiz RCE.

5 Mins Read

Welcome to the Wallarm weekly web exploits digest! Since this week, we will publish our weekly digests consists of web exploits with CVSS scores higher than 5. It will be followed by explanations, risks analysis, related stories and news. So, here we go!

The most sophisticated and interesting exploit was out of this score for some reason, but who we are to argue with CVSS score 😉 This is the Apache OFBiz XML-RPC Java Serialization Remote Code Execution issues https://vulners.com/packetstorm/PACKETSTORM:161769 where you can find a XML-packed and Base64 encoded Java deserialization payload:

<name>#{rand_text_alphanumeric(8..42)}</name>  
<value>  
<serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">#{Rex::Text.encode_base64(data)}</serializable>  
</value>

Read More
In Researcher Corner

Why WAFs can’t catch VMware CVE-2021-21972 Remote Code Execution Exploit?

3 Mins Read

The recent critical security issue in VMware vCenter was discovered this January and fixed on February 23rd https://www.vmware.com/security/advisories/VMSA-2021-0002.html. The exploit looks like a simple JSP shell upload, but for some reason, it’s a blind spot for Web Application Firewalls (WAFs). Let’s understand why. The CVE-2021-21972 affects vCenter versions 6.5, 6.7, and 7.0. The exploit for Metasploit released https://vulners.com/packetstorm/PACKETSTORM:161695 today. The exploit description is pretty straight forward “This module exploits an unauthenticated OVA file upload and path traversal in VMware…

Read More