VMware addresses SSRF flaw in vRealize Operations that allows stealing admin credentials

VMware addressed a high severity vulnerability in vRealize Operations that could allow stealing admin credentials from vulnerable servers.

VMware has published security updates to address multiple vulnerabilities in VMware vRealize Operations that could allow threat actors to steal admin credentials from vulnerable installs.

VMware vRealize Operations is a self-driving and AI-powered platform for the management of IT operations for private, hybrid, and multi-cloud environments. The solution is available as an on-premises or SaaS solution.

The most severe vulnerability, tracked as CVE-2021-21975, is a Server Side Request Forgery in vRealize Operations Manager API, it received a CVSSv3 base score of 8.6.

“The vRealize Operations Manager API contains a Server Side Request Forgery. VMware has evaluated this issue to be of ‘Important’ severity with a maximum CVSSv3 base score of 8.6.” reads the advisory published by the virtualization giant.

“A malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.”

A remote, unauthenticated attacker can exploit the vulnerability without user interaction to steal administrative credentials.

The vulnerability was reported to VMware by security researcher Egor Dimitrenko from Positive Technologies.

The company also addressed an arbitrary file write vulnerability in vRealize Operations Manager API tracked as CVE-2021-21983 that received a CVSSv3 base score of 7.2.

“An authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system.” reads the advisory published by the company. “To remediate CVE-2021-21983 apply the updates listed in the ‘Fixed Version’ column of the ‘Response Matrix’ below to affected deployments.”

Impacted products include:

• VMware vRealize Operations
• VMware Cloud Foundation
• vRealize Suite Lifecycle Manager

VMware also announced the availability of workarounds for customers that can’t immediately install the security updates.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, SSRF)

[adrotate banner=”5″]

[adrotate banner=”13″]