Sploitus

Exploit for Improper Input Validation in Vmware View Planner

CVE-2021-21978

githubexploit · 2021-03-05

Exploit Code

README75 lines
## https://sploitus.com/exploit?id=A5396B72-7F7D-5109-9A41-571016422FB5
# CVE-2021-21978
A simpler way to bring back the vulnerable exploit script

## 0. Vulnerability Information
The VMware View Planner Web management interface has a feature for uploading log files. This feature lacks authentication, and the path where the logs are written is controllable by users. By overwriting the `logUpload_wsgi.py` file, an RCE vulnerability can be exploited.

Vulnerability Code:
```python
def application(environ, start_response):
    logger.debug("Application called.")

    if environ['REQUEST_METHOD'] == 'POST':
        post = cgi.FieldStorage(
            fp=environ['wsgi.input'],
            environ=environ,
            keep_blank_values=True
        )

        # TO DO: The path to the log file is already available in some configuration or read from the configuration.
        resultBasePath = "/etc/httpd/html/vpresults"
        try:
            filedata = post["logfile"]
            metaData = post["logMetaData"]

            if metaData.value:
                logFileJson = LogFileJson.from_json(metaData.value)

            if not os.path.exists(os.path.join(resultBasePath, logFileJson.itrLogPath)):
                os.makedirs(os.path.join(resultBasePath, logFileJson.itrLogPath))

            if filedata.file:
                if (logFileJson.logFileType == agentlogFileType.WORKLOAD_ZIP_LOG):
                    filePath = os.path.join(resultBasePath, logFileJson.itrLogPath, WORKLOAD_LOG_ZIP_ARCHIVE_FILE_NAME.format(str(logFileJson.workloadID)))
                else:
                    filePath = os.path.join(resultBasePath, logFileJson.logFileType)
                with open(filePath, 'wb') as output_file:
                    while True:
                        data = filedata.file.read(1024)
                        # End of file
                        if not data:
                            break
                        output_file.write(data)
```

## 1. Dependencies
```
pip install requests
```

## 2. Detection
```
git clone https://github.com/skytina/CVE-2021-21978
cd CVE-2021-21978
python3 CVE-2021-21978.py https://192.168.80.3/
```

![image-20210305162131318](./images/detect.png)

## 3. Exploitation
The exploit script overwrites `logUpload_wsgi.py`, turning it into a backdoor.

![image-20210305162339613](./images/backdoor.png)

## 4. Reference Links
Source of the exploit: https://twitter.com/osama_hroot/status/1367258907601698816

VMware Official Notice: https://www.vmware.com/security/advisories/VMSA-2021-0003.html

## Statement
- The tool is only used for security testing and research by security personnel. Any direct or indirect consequences and losses caused by unauthorized testing are the responsibility of the user. If you find the above information helpful, you can follow the official account.

![![](./images/qrcode_for_gh_0b1156c93460_258.jpg)]

[source-iocs-preserved method=os.path.join(resultBasePath, logFileJson.itrLogPath, logFileJson.logFileType)]