‘Unauthorized API’ in VMware cost management tool can be exploited to hijack appliances
(2021/05/06)
- Reference: 1620269554
- News link: https://www.theregister.co.uk/2021/05/06/unauthorised_api_vmware_vrealize/
- Source link:
VMware has admitted its vRealize Business for Cloud product includes an “unauthorised VAMI API” that can be exploited to achieve remote code execution on the virtual appliance. The security flaw is rated critical, scoring 9.8 on the ten-point Common Vulnerability Scoring System.
VAMI is the vCenter Server Appliance Management Interface, the tool administrators use to drive its flagship vCenter Server Appliance and manage fleets of virtual machines. For VAMI to have an "unauthorised" API that can be abused by miscreants to gain unauthorized control of systems over the network or internet is very scary indeed.
VMware’s [1]advisory does not explain how an unauthorised API made its way into such a sensitive product.
[2]
[3]
The advisory does reveal that the security slip-up means “a malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance."
That’s scary, too, because vRealize Business for Cloud is aware of the disposition of private and public cloud resources and is [4]billed as offering the chance to “view and update the status of critical internal business processes to understand the overall system health.”
The good news is that only version 7.6 of the product is impacted, although it was released in July 2019. Patches can be accessed [5]here .
[6]
VMware has thanked Egor Dimitrenko of Positive Technologies for reporting the vulnerability, which is known as CVE-2021-21984. ®
Get our [7]Tech Resources
[1] https://www.vmware.com/security/advisories/VMSA-2021-0007.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/virtualization&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJNp2SKNRWwCCuoP-XK0nAAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/virtualization&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJNp2SKNRWwCCuoP-XK0nAAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://docs.vmware.com/en/vRealize-Business/7.6/vRBforCloud.user.doc/GUID-0EC5D1E3-A68C-4273-B607-16C8400525C2.html
[5] https://kb.vmware.com/s/article/83475
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/virtualization&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJNp2SKNRWwCCuoP-XK0nAAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://whitepapers.theregister.com/
VAMI is the vCenter Server Appliance Management Interface, the tool administrators use to drive its flagship vCenter Server Appliance and manage fleets of virtual machines. For VAMI to have an "unauthorised" API that can be abused by miscreants to gain unauthorized control of systems over the network or internet is very scary indeed.
VMware’s [1]advisory does not explain how an unauthorised API made its way into such a sensitive product.
[2]
[3]
The advisory does reveal that the security slip-up means “a malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance."
That’s scary, too, because vRealize Business for Cloud is aware of the disposition of private and public cloud resources and is [4]billed as offering the chance to “view and update the status of critical internal business processes to understand the overall system health.”
The good news is that only version 7.6 of the product is impacted, although it was released in July 2019. Patches can be accessed [5]here .
[6]
VMware has thanked Egor Dimitrenko of Positive Technologies for reporting the vulnerability, which is known as CVE-2021-21984. ®
Get our [7]Tech Resources
[1] https://www.vmware.com/security/advisories/VMSA-2021-0007.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/virtualization&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJNp2SKNRWwCCuoP-XK0nAAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/virtualization&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJNp2SKNRWwCCuoP-XK0nAAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://docs.vmware.com/en/vRealize-Business/7.6/vRBforCloud.user.doc/GUID-0EC5D1E3-A68C-4273-B607-16C8400525C2.html
[5] https://kb.vmware.com/s/article/83475
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/virtualization&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJNp2SKNRWwCCuoP-XK0nAAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://whitepapers.theregister.com/