CVE-2021-21985: VMware vCenter Server RCE Vulnerability

CVE-2021-21985 Overview

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

This vulnerability represents a severe threat to enterprise virtualization infrastructure, as vCenter Server is a critical component managing VMware vSphere environments. The lack of input validation in a default-enabled plugin creates an easily exploitable attack surface that requires no authentication.

Critical Impact

Remote attackers with network access to port 443 can achieve complete system compromise with unrestricted privileges on the underlying vCenter Server host operating system. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

Affected Products

• VMware vCenter Server 6.5 (all versions through Update 3n)
• VMware vCenter Server 6.7 (all versions through Update 3m)
• VMware vCenter Server 7.0 (all versions through Update 2a)
• VMware Cloud Foundation 3.x and 4.x

Discovery Timeline

• 2021-05-26 - CVE-2021-21985 published to NVD
• 2025-10-30 - Last updated in NVD database

Technical Details for CVE-2021-21985

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in the Virtual SAN Health Check plug-in, combined with Server-Side Request Forgery (SSRF) characteristics (CWE-918). The vSphere Client (HTML5) fails to properly sanitize user-supplied input before processing it, allowing attackers to inject malicious commands.

The Virtual SAN Health Check plug-in is enabled by default in vCenter Server deployments, significantly increasing the attack surface. The plugin is designed to monitor and report on the health status of Virtual SAN (vSAN) clusters, but the lack of proper input validation transforms this monitoring functionality into an attack vector.

When exploited, this vulnerability allows attackers to execute arbitrary commands with the same privileges as the vCenter Server service account, which typically runs with elevated or root-level permissions on the underlying operating system. This makes it particularly dangerous as successful exploitation grants complete control over the virtualization management infrastructure.

Root Cause

The root cause of CVE-2021-21985 is the failure to implement proper input validation within the Virtual SAN Health Check plug-in component. The plugin accepts and processes user input without adequate sanitization, allowing specially crafted requests to be interpreted as executable commands.

The vulnerability is compounded by the fact that the affected plugin is enabled by default, meaning all standard vCenter Server installations are vulnerable unless explicitly mitigated. The plugin's network-accessible nature via port 443 (HTTPS) means that any system with network connectivity to the vCenter Server can potentially exploit this flaw.

Attack Vector

The attack can be executed remotely over the network, requiring only network access to port 443 on the vulnerable vCenter Server. The exploitation process does not require any authentication or user interaction, making it highly attractive to threat actors.

Attackers can craft malicious HTTP/HTTPS requests targeting the Virtual SAN Health Check plug-in endpoints. These requests contain specially crafted payloads that bypass input validation and result in command execution on the underlying operating system. Due to the unauthenticated nature of the attack, exploitation can be automated and scaled across multiple targets.

The vulnerability has been actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities catalog. Technical details and exploit code have been published on Packet Storm Security, facilitating widespread exploitation attempts.

Detection Methods for CVE-2021-21985

Indicators of Compromise

• Unusual outbound network connections from vCenter Server systems to unknown external IP addresses
• Unexpected processes spawned by the vCenter Server service account, particularly shell interpreters or system utilities
• Suspicious HTTP/HTTPS requests to Virtual SAN Health Check plugin endpoints containing encoded or obfuscated payloads
• New user accounts or SSH keys added to the vCenter Server appliance without authorization
• Modifications to critical vCenter configuration files or service startup scripts

Detection Strategies

• Implement network intrusion detection signatures for known CVE-2021-21985 exploitation patterns targeting the vSAN Health Check endpoints
• Monitor vCenter Server logs for anomalous API calls or repeated failed requests to the affected plugin
• Deploy endpoint detection and response (EDR) solutions on vCenter Server systems to identify malicious process execution chains
• Establish baseline network behavior for vCenter Server and alert on deviations, particularly unexpected outbound connections

Monitoring Recommendations

• Enable verbose logging on vCenter Server and forward logs to a centralized SIEM for correlation and analysis
• Monitor for authentication bypass attempts and unauthorized access patterns to the vSphere Client interface
• Implement file integrity monitoring on critical vCenter Server system files and configuration directories
• Track process execution on vCenter Server hosts, alerting on unusual command interpreters or reconnaissance tools

How to Mitigate CVE-2021-21985

Immediate Actions Required

• Apply VMware security patches immediately to all affected vCenter Server and Cloud Foundation deployments
• If patching is not immediately possible, disable the Virtual SAN Health Check plug-in as a temporary workaround
• Restrict network access to vCenter Server port 443 to only authorized management networks and administrators
• Review vCenter Server systems for signs of compromise before and after patching
• Implement network segmentation to limit exposure of vCenter Server to untrusted networks

Patch Information

VMware has released security updates to address this vulnerability. Organizations should apply the appropriate patches based on their vCenter Server version:

• vCenter Server 7.0: Update to version 7.0 U2b or later
• vCenter Server 6.7: Update to version 6.7 U3n or later
• vCenter Server 6.5: Update to version 6.5 U3p or later
• Cloud Foundation: Apply the corresponding updates for versions 3.x and 4.x

Detailed patch information and download links are available in the VMware Security Advisory VMSA-2021-0010.

Workarounds

• Disable the Virtual SAN Health Check plug-in by editing the compatibility matrix file and setting the plugin to incompatible
• Implement strict firewall rules to limit access to vCenter Server port 443 from trusted IP addresses only
• Consider temporarily taking vCenter Server offline if patching cannot be performed immediately and the system shows signs of exposure
• Deploy web application firewall (WAF) rules to filter malicious requests targeting the vulnerable endpoints

# Example: Disable vSAN Health Check Plugin (temporary workaround)
# Navigate to the plugin directory on vCenter Server appliance
cd /etc/vmware/vsphere-ui/vc-packages/vsphere-client-serenity/

# Edit the compatibility matrix to disable the vSAN Health Check plugin
# Set the plugin's compatibility to "incompatible"
# Note: Consult VMware documentation for exact file paths based on your version

# After making changes, restart the vSphere Client services
service-control --restart vsphere-ui
service-control --restart vsphere-client