VMware vCenter Exploit - CVE-2021-22005

VMware vCenter Server enables the management of virtual environments for Windows and Linux hosts. The Analytics service in vCenter has a vulnerability that allows an unauthenticated attacker to successfully upload a file with a malicious payload. The attacker sends a specially crafted HTTP POST request, which contains the malicious payload and path traversal fragments in a query parameter value, to an Analytics service endpoint on port 443 (1). The vulnerable vCenter sends a response to indicate that the malicious POST request was accepted (2) and runs malicious code in the file on the server.