VMware vCenter Scan - CVE-2021-21972

The VMware vSphere Client (HTML5) component of VMware vCenter enables management of virtual environments for Windows and Linux hosts. vCenter has plugins that manage authorization for the vSphere Client connections. A vulnerability in the vRealize Operations (vROPS) plugin allows an unauthenticated attacker with network access to a vSphere Client to upload malicious files to the vCenter server. Before exploiting a target, the attacker must first confirm that the target is vulnerable. The attacker scans for the vulnerability by sending an HTTP GET request to the /uploadova endpoint. A patched server should respond with an “access denied” error (such as 403 or 401). Instead, a vulnerable server responds with a “method not allowed” (such as 405) error.