CVE-2021-21998: VMware Carbon Black Authentication Bypass

CVE-2021-21998 Overview

CVE-2021-21998 is an authentication bypass vulnerability in VMware Carbon Black App Control. The flaw affects versions 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2. An attacker with network access to the App Control management server can obtain administrative access without authenticating. VMware disclosed the issue in advisory VMSA-2021-0012 and assigned a CVSS v3.1 base score of 9.8. The vulnerability is classified under [CWE-287] Improper Authentication.

Critical Impact
Unauthenticated network attackers can gain administrative control over the Carbon Black App Control management server, undermining application allowlisting policies across protected endpoints.

Affected Products

VMware Carbon Black App Control 8.0 (all builds)
VMware Carbon Black App Control 8.1 (all builds)
VMware Carbon Black App Control 8.5 prior to 8.5.8
VMware Carbon Black App Control 8.6 prior to 8.6.2

Discovery Timeline

2021-06-23 - CVE-2021-21998 published to NVD alongside VMware advisory VMSA-2021-0012
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-21998

Vulnerability Analysis

Carbon Black App Control enforces application allowlisting on Windows servers and endpoints. The management server provides administrators a web console and APIs to define policies, approve binaries, and review events. CVE-2021-21998 breaks the trust boundary of this console.

The flaw permits a malicious actor with network reachability to the management server to authenticate as an administrator without supplying valid credentials. Once authenticated, the attacker inherits full management privileges over the App Control deployment. This includes modifying allowlisting rules, approving arbitrary binaries, disabling enforcement, and exporting sensitive policy data.

The attack requires no user interaction and no prior privileges. Exploitation occurs over the network against the management interface. The result is full compromise of confidentiality, integrity, and availability for the App Control product, as reflected in the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector.

Root Cause

The root cause is improper authentication ([CWE-287]) in the App Control management server. VMware's advisory does not publish a code-level breakdown, but the defect allows a request path to reach administrative functionality without validating session or credential state. Consult VMware Security Advisory VMSA-2021-0012 for vendor details.

Attack Vector

An attacker needs network access to the Carbon Black App Control management server. From there, the attacker issues crafted requests to the management interface that bypass the authentication layer. Because App Control is itself a security control, takeover of the management server gives the attacker the ability to neutralize endpoint protections it enforces, then pivot into managed hosts using approved-binary policies.

No public proof-of-concept is currently catalogued in Exploit-DB, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. EPSS data places exploitation probability in the mid-range, indicating the issue remains relevant for unpatched deployments.

Detection Methods for CVE-2021-21998

Indicators of Compromise

Unexpected administrative logins to the App Control console from unfamiliar source IP addresses or outside maintenance windows.
New or modified application approval rules, policy changes, or enforcement-level downgrades that do not correlate with a change ticket.
Creation of new administrator accounts or API tokens in App Control without an approving change record.
Outbound connections from the App Control management server to untrusted destinations following anomalous console activity.

Detection Strategies

Review App Control audit logs for administrator actions that lack a preceding successful interactive authentication event.
Correlate web server and application logs on the management host to identify requests reaching administrative endpoints without prior session establishment.
Alert on policy export, rule deletion, and agent tamper-protection toggles, treating these as high-severity events when source attribution is missing.

Monitoring Recommendations

Forward App Control management server logs to a centralized SIEM and retain them for the duration required by incident response policy.
Monitor network flows to the management interface and restrict acceptable source networks at the firewall, alerting on any allowed-but-unusual source.
Baseline normal administrator activity volume and times, then alert on deviations such as off-hours rule changes.

How to Mitigate CVE-2021-21998

Immediate Actions Required

Upgrade Carbon Black App Control to version 8.5.8, 8.6.2, or later as directed in VMSA-2021-0012.
Restrict network access to the management server so only authorized administrative networks can reach it.
Audit existing App Control administrator accounts, API tokens, and recent policy changes for unauthorized modifications.
Rotate administrator credentials and API keys after patching if compromise cannot be ruled out.

Patch Information

VMware released fixed builds in App Control 8.5.8 and 8.6.2. Versions 8.0 and 8.1 are within the impacted range; customers running these branches should upgrade to a fixed release line. Refer to VMware Security Advisory VMSA-2021-0012 for build numbers, download locations, and upgrade procedures.

Workarounds

No vendor workaround is published. Apply the patch as the primary remediation.
Until patching completes, place the management server behind a jump host or VPN and block direct access from general user networks.
Enable multi-factor authentication on upstream access controls such as the VPN or bastion to reduce exposure of the management interface.

bash

# Example firewall restriction limiting App Control management access to an admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP