Medium · published February 24, 2021
CVSS calls it medium at 5.3. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
⚠️ The vSphere Client is letting slip through the cracks! An SSRF vulnerability in the vCenter Server plugin allows attackers to sneakily access sensitive information with just a simple POST request! 🔍 Think of it like a delivery service that doesn't check the contents of every package it accepts. If a malicious actor sends in a request dressed up as a legitimate delivery, they could gain access to confidential information as if they were receiving a special package just for them. An attacker with network access to port 443 could exploit this vulnerability to reveal sensitive data from the vCenter Server. This could lead to unauthorized information disclosure, potentially compromising your environment and exposing your organization to further risks.
Think of it like a delivery service that doesn't check the contents of every package it accepts. If a malicious actor sends in a request dressed up as a legitimate delivery, they could gain access to confidential information as if they were receiving a special package just for them. This SSRF vulnerability arises from improper validation of URLs in the vCenter Server plugin, allowing unauthorized requests to be processed. This means a crafted POST request can trick the server into revealing internal resources, opening the door to sensitive information.
An attacker with network access to port 443 could exploit this vulnerability to reveal sensitive data from the vCenter Server. This could lead to unauthorized information disclosure, potentially compromising your environment and exposing your organization to further risks. To protect your systems, ensure you update to the patched versions: VMware vCenter Server (7.0 U1c, 6.7 U3l, 6.5 U3n) and VMware Cloud Foundation (4.2, 3.10.1.2). Additionally, review your network access policies and monitor traffic on port 443 for any suspicious activities. You've got this! Implement these fixes, and you'll fortify your defenses in no time! 🛡️