Critical Auth Bypass Bug Found in VMware Data Center Security Product

A critical vulnerability in the VMware Carbon Black Cloud
Workload appliance could be exploited to bypass authentication and
take control of vulnerable systems.

Tracked as CVE-2021-21982, the flaw is rated 9.1 out of a
maximum of 10 in the CVSS scoring system and affects all versions
of the product prior to 1.0.1.

Carbon Black Cloud Workload is a data center security product
from VMware that aims to protect critical servers and workloads
hosted on vSphere, the company’s cloud-computing virtualization
platform.

“A URL on the administrative interface of the VMware Carbon
Black Cloud Workload appliance can be manipulated to bypass
authentication,” VMware said^[1]
in its advisory, thereby allowing an adversary with network access
to the interface to gain access to the administration API of the
appliance.

Armed with the access, a malicious actor can then view and alter
administrative configuration
settings^[2], the company added.

In addition to releasing a fix for CVE-2021-21982, VMware has
also addressed^[3]
two separate bugs in its vRealize Operations Manager solution that
an attacker with network access to the API could exploit to carry
out Server Side Request Forgery (SSRF^[4]) attacks to steal
administrative credentials (CVE-2021-21975) and write files to
arbitrary locations on the underlying photon^[5] operating system
(CVE-2021-21983).

The product is primarily designed to monitor and optimize the
performance of the virtual infrastructure and support features such
as workload balancing, troubleshooting, and compliance
management.

Egor Dimitrenko, a security researcher with Positive
Technologies, has been credited with reporting all three flaws.

“The main risk is that administrator privileges allow attackers
to exploit the second vulnerability—CVE-2021-21983 (an arbitrary
file write flaw, scored 7.2), which allows executing any commands
on the server,” Dimitrenko said^[6]. “The combination of two
security flaws makes the situation even more dangerous, as it
allows an unauthorized attacker to obtain control over the server
and move laterally within the infrastructure.”

VMware has released patches for vRealize Operations Manager
versions 7.0.0, 7.5.0, 8.0.1, 8.1.1, 8.2.0 and 8.3.0. The company
has also published workarounds to mitigate the risks associated
with the flaws in scenarios where the patch cannot be installed or
is not available.