Rapid7 Vulnerability & Exploit Database

VMware vRealize Operations (vROps) Manager SSRF RCE

Back to Search

VMware vRealize Operations (vROps) Manager SSRF RCE

Disclosed
03/30/2021
Created
04/27/2021

Description

This module exploits a pre-auth SSRF (CVE-2021-21975) and post-auth file write (CVE-2021-21983) in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload. CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the /casa/private/config/slice/ha/certificate endpoint. Code execution occurs as the "admin" Unix user. The following vRealize Operations Manager versions are vulnerable: * 7.0.0 * 7.5.0 * 8.0.0, 8.0.1 * 8.1.0, 8.1.1 * 8.2.0 * 8.3.0 Version 8.3.0 is not exploitable for creds and is therefore not supported by this module. Tested successfully against 8.0.1, 8.1.0, 8.1.1, and 8.2.0.

Author(s)

  • Egor Dimitrenko
  • wvu <wvu@metasploit.com>

Platform

Linux

Architectures

java

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/vmware_vrops_mgr_ssrf_rce
msf exploit(vmware_vrops_mgr_ssrf_rce) > show targets
    ...targets...
msf exploit(vmware_vrops_mgr_ssrf_rce) > set TARGET < target-id >
msf exploit(vmware_vrops_mgr_ssrf_rce) > show options
    ...show and set options...
msf exploit(vmware_vrops_mgr_ssrf_rce) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;