Description
VMware vCenter Server 是美国威睿（VMware）公司开发的一套服务器和虚拟化管理软件。该漏洞存在于 vCenter Server 的 /ui/vcav-bootstrap/rest/vcav-providers/provider-logo 接口中，攻击者可以通过构造恶意请求读取服务器上的任意文件，可能导致敏感信息泄露，例如系统配置文件和用户凭据。
VMware vCenter Server /ui/vcav-bootstrap/rest/vcav-providers/provider-logo 文件读取漏洞（CVE-2021-21986）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2021-21986
https://www.vmware.com/security/advisories/VMSA-2021-0010.html
https://www.sentinelone.com/vulnerability-database/cve-2021-21986/
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23602
https://www.tesorion.nl/t-updates-en/vmware-vcenter-public-poc-cve-2021-21986
https://www.levelblue.com/blogs/spiderlabs-blog/thousands-of-vulnerable-vmware-vcenter-servers-still-publicly-exposed-cve-2021-21985-cve-2021-21986
https://www.rapid7.com/db/vulnerabilities/vmsa-2021-0010-cve-2021-21986-vcenter/
https://www.cve.org/CVERecord?id=CVE-2021-21986
https://community.broadcom.com/vmware-cloud-foundation/discussion/addressing-vmsa-2021-0010-and-related-cves-cve-2021-21985-cve-2021-21986
https://www.tenable.com/blog/cve-2021-21985-critical-vmware-vcenter-server-remote-code-execution