Description
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | VMware vCenter Server and VMware Cloud Foundation | VMware vCenter Server (7.x before 7.0 U2b, 6.7 before 6.7 U3n, 6.5 before 6.5 U3p) and VMware Cloud Foundation (4.x before 4.2.1, 3.x before 3.10.2.1) | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
VMware vCenter Server Virtual SAN Health Check Plugin RCE
exploit/linux/http/vmware_vcenter_vsan_health_rce
GitHub 10 repositories
-
alt3kx/CVE-2021-21985_PoC ★ 213 · May 29, 2021
-
xnianq/cve-2021-21985_exp ★ 115 · Jun 3, 2021
cve-2021-21985 exploit
-
testanull/Project_CVE-2021-21985_PoC ★ 28 · Jun 5, 2021
-
sknux/CVE-2021-21985_PoC ★ 3 · Nov 9, 2021
VMWARE VCENTER SERVER VIRTUAL SAN HEALTH CHECK PLUG-IN RCE (CVE-2021-21985)
-
daedalus/CVE-2021-21985 ★ 2 · Jun 4, 2021
CVE-2021-21985 vmware 6.7-9.8 RCE
-
onSec-fr/CVE-2021-21985-Checker ★ 2 · Jun 1, 2021
CVE-2021-21985 Checker.
-
haidv35/CVE-2021-21985 ★ 1 · Jul 8, 2021
-
bigbroke/CVE-2021-21985 ★ 1 · May 27, 2021
Multiple vulnerabilities in the vSphere Client (HTML5) were privately reported to VMware. Updates and workarounds are available to address these vulnerabilities in affected VMware products.
-
aristosMiliaressis/CVE-2021-21985 ★ 0 · Jul 11, 2021
cve-2021-21985 powershell poc
-
mauricelambert/CVE-2021-21985 ★ 0 · Jun 1, 2021
This script check the CVE-2021-21985 vulnerability and patch on vCenter Server.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- VMware vSphere Client (HTML5) - Remote Code Execution http/cves/2021/CVE-2021-21985.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.