Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
This vCenter vulnerability is well known. A successful exploit requires skills and reconnaissance. An unauthenticated attacker with network access to a vulnerable device can gain complete control of a device, providing an entry point for further attacks on your network.
Kill Chain
Risk Score
88
The VMware vSphere Client (HTML5) component of VMware vCenter enables management of virtual environments for Windows and Linux hosts. vCenter has plugins that manage authorization for vSphere Client connections. A vulnerability in the vRealize Operations (vROPS) plugin allows an unauthenticated attacker with network access to a vSphere Client to upload malicious files to the vCenter server. After scanning the target to confirm the presence of the vulnerability, the attacker sends an HTTP POST request with a malicious TAR file to the /uploadova endpoint. Normally, the vROPS plugin decompresses and writes the file content to a restricted directory. But the malicious archive file includes directory traversal fragments, which force the vROPS plugin to write the file content to a directory that the unauthenticated attacker can access. After the vCenter server sends an HTTP response with a success message, the attacker can leverage the malicious file content to install a web shell, exfiltrate data, or perform actions on the vCenter server.
