{"uuid": "38592bbc-dad0-4cbf-9959-2ffba0795e1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-22005", "type": "seen", "source": "https://t.me/hacking_Attack/25128", "content": "Black Hat Ethical Hacking\nHackers exploiting critical VMware vCenter CVE-2021-22005 bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hackers exploiting critical VMware vCenter CVE-2021-22005 bugPost Views: 172 \nReading Time: 1 Minute\nExploit code that could be used for remote code execution on VMware vCenter Server vulnerable to CVE-2021-22005 has been released today and attackers are already using it.\nPublicly disclosed earlier this week when VMware also addressed it, the bug comes with a critical severity\u00a0rating of 9.8 and a strong recommendation to install the available patch. Attacks have startedThe vulnerability affects machines running vCenter Server versions 6.7, and 7.0. Given the severity of the issue, VMware urges administrators to act immediately\u00a0under the assumption that an adversary is already on the network, ready to take advantage.\n\nExposed vCenter servers are currently being targeted from various countries over multiple ports, threat intelligence company Bad Packets\u00a0shared with BleepingComputer today; VMware confirmed this\u00a0in an update to their security advisory for\u00a0CVE-2021-22005, an arbitrary file upload vulnerability:\n\u201cVMware has confirmed reports that CVE-2021-22005 is being exploited in the wild\u201d\nData recorded by Bad Packets shows attacks starting to hit their VMware honeypots at\u00a016:21 (GMT)\u00a0originating from\u00a0Canada,\u00a0the U.S., Romania,\u00a0the Netherlands, China, and Singapore.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nSigns of these attacks coming were seen shortly after VMware disclosed the security issue and released a patch. Just hours later, Bad Packets saw scanning activity targeting CVE-2021-22005. The spark for the exploitTroy Mursch, chief research officer at Bad Packets, told BleepingComputer that the attacks he saw against the company honeypots used code based on an incomplete exploit released earlier today by\u00a0Vietnamese security researcher Jang.\n\nJang published technical notes\u00a0for CVE-2021-22005 based on the workaround and the patch from VMware.\u00a0The details are enough for experienced developers to create a working exploit that allows remote code execution with root privileges, the researcher told BleepingComputer.\n\nAt the end of the post, Jang also provides a link to his PoC version for CVE-2021-22005. It is not a fully functional variant, though, intentionally so to prevent less skilled threat actors from using it in attacks directly.\n\nThe researcher told us that in its current form the code does no harm\u00a0because it is missing the important part leading to remote code execution.\n\nAn adversary would have to put in some effort to turn it into a full-fledged exploit but they should be able to create an exploit that is 100% reliable.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges Penetration tester and Synack Envoy Nicolas Krassas\u00a0tested the code and confirmed that it needs some modifications to work properly. But it does prove that CVE-2021-22005 can be used to create a backdoor on a vulnerable system. Attacks were imminentJang built a fully functional exploit and tested it in a controlled environment. He said that it works just fine, obtaining remote code execution before detection can catch it.\n\nCurrently, search engines for internet-connected devices show thousands of VMware vCenter Server instances exposed to the public internet. Shodan retrieved more than 5,000 machines\u00a0while a rough search on Censys shows around 6,800.\nhttps://www.bleepstatic.com/images/news/u/1100723/2021/Vulnerabilities/censys_vmware-1-1024x603.png \n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.566284Z"}