CVE-2021-22005
VMware vCenter Server — VMware vCenter Server File Upload Vulnerability
Description
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2021-22005 is an unauthenticated remote code execution vulnerability (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) in the vCenter Analytics service, exploitable over port 443 with no credentials whatsoever — an attacker with network access gains immediate root-level control over the hypervisor management plane and, by extension, every VM it manages. The EPSS score of 1.0 (100th percentile) reflects the wide availability of public exploit code, and CISA has explicitly flagged this CVE as used in ransomware campaigns. For NIS2-scoped organisations running VMware-based virtualisation, the blast radius is maximal: a compromised vCenter instance enables lateral movement across all connected systems, bulk data exfiltration, and full encryption of the virtualised environment. Patch deployment is the absolute top priority; until it is complete, network isolation of the management interface is the only effective compensating control.
Runbook · Step 1
Immediate response (0-24 h)
- Apply the vendor patch immediately: VMware Security Advisory VMSA-2021-0020 contains the fix. vCenter Server 6.5 → patch 6.5 U3q, vCenter Server 6.7 → patch 6.7 U3o, vCenter Server 7.0 → patch 7.0 U2d. Cloud Foundation 3.x and 4.x: follow the patch matrix in VMSA-2021-0020. Verify the exact build number in the vendor advisory, as VMware has released subsequent patches.
- Restrict network access to port 443 on the vCenter management interface immediately: Only dedicated management workstations and jump hosts should be permitted to reach TCP 443 on vCenter — block all other source ranges via firewall ACL.
- Disable the Analytics service as a workaround: VMware published an official workaround script (
/usr/lib/vmware-analytics/bin/disable-analytics.sh). Run it on every unpatched vCenter instance now and leave it in place until the patch is applied. - Hunt for indicators of compromise: Inspect
/etc/vmware-analytics/and/var/log/vmware/analytics/for unknown files; search the vCenter web root for web-shell artefacts (.jsp,.war,.py). - Rotate vCenter SSO and service-account credentials: Change all vCenter SSO administrator passwords and linked AD service accounts immediately — successful exploitation grants full control over the vSphere environment.
Runbook · Step 2
Mitigation layers
- Network segmentation (tiering): Place the vCenter management interface in a dedicated management VLAN; enforce firewall policy to block east-west traffic between production VMs and the management network.
- WAF/IPS rule: Block or alert on inbound POST requests to
/analytics/telemetry/ph/api/hyper/sendcarrying unusual Content-Types (e.g.multipart/form-datawith executable file extensions). Suricata signature approach:alert http any any -> $VCENTER_IP 443 (msg:"CVE-2021-22005 exploit attempt"; http.uri; content:"/analytics/telemetry/ph/api/hyper/send"; http.method; content:"POST"; filedata; content:".jsp"; sid:9000001;). - Least-privilege for vCenter roles: Ensure no production workloads or non-admin users can establish direct network connections to vCenter port 443 — enforce zero-trust segmentation at the hypervisor layer.
- Enable logging and SIEM forwarding: Configure vCenter syslog forwarding to an external, append-only log server so that an attacker cannot cover tracks after a compromise.
- Authenticated vulnerability scan: Scan all vCenter instances (including embedded PSC deployments) against VMSA-2021-0020; isolate any unpatched instance from the production network immediately.
Runbook · Step 3
Detection rules
- Web-server access log (vCenter HTTPS log): Anomalous POST requests to
/analytics/telemetry/ph/api/hyper/sendwithout a legitimate VMware telemetry User-Agent string — SPL:index=vcenter sourcetype=vcenter_access uri_path="*/analytics/telemetry/ph/api/hyper/send" method=POST | where NOT match(useragent, "VMware"). - Filesystem monitoring (Linux auditd / inotify): New files with executable extensions (
.jsp,.sh,.py) appearing in/etc/vmware-analytics/,/var/log/vmware/analytics/, or the vCenter web root — auditd rule:-w /etc/vmware-analytics/ -p wa -k cve_2021_22005. - Process anomaly (EDR on vCenter appliance): Child processes of
vmware-analyticsorvmwarespsspawning shell interpreters (/bin/sh,/bin/bash,python) — Sigma shape:process.parent.name: vmware-analytics AND process.name: (sh OR bash OR python*). - Network telemetry (Zeek/Suricata): Outbound connections from the vCenter host to external IPs on non-standard ports shortly after an inbound POST to the Analytics endpoint — indicative of a reverse-shell callback.
- vSphere Event Log: Unexpected changes to global permissions or new SSO administrator accounts created shortly after an anomalous API call — review in the vSphere Client under "Events" or via
Get-VIEventin PowerCLI.
Metrics
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
vmware
cloud_foundation3.0 – 5.0
vmware
vcenter_server
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlx_refsource_MISC
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlx_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005government-resource