CVE-2021-21974
HIGH EXPLOITED IN THE WILD RANSOMWAREVMware ESXi Remote Code Execution via OpenSLP Heap Overflow
Title source: llmExploitation Summary
CVE-2021-21974 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns. EIP tracks 7 public exploits from researchers including Shadow0ps, CYBERTHREATANALYSIS, n2x4.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-21974, a vulnerability in the Service Location Protocol (SLP) that allows remote code execution. The exploit leverages crafted SLP packets to trigger a heap-based buffer overflow, leading to arbitrary command execution.
Description
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.
Exploits (7)
This repository contains a functional exploit for CVE-2021-21974, a vulnerability in the Service Location Protocol (SLP) that allows remote code execution. The exploit leverages crafted SLP packets to trigger a heap-based buffer overflow, leading to arbitrary command execution.
This repository contains a Python-based scanner that checks ESXi servers for signs of ransomware compromise by fetching HTML content and searching for specific ransom note strings. It supports single IP, CSV, and JSON input formats but does not exploit any vulnerability.
This repository contains scripts for scraping and analyzing ransomware-related data from Shodan and Censys, specifically targeting systems affected by CVE-2021-21974. It includes tools to gather IP addresses, wallet addresses, and transaction details but does not include functional exploit code.
This repository contains a Python-based vulnerability detection tool for CVE-2021-21974, which targets VMware ESXi's SLP service. It tests for potential vulnerabilities by sending crafted SLP packets and analyzing responses without exploiting the vulnerability.
The repository contains a functional Python-based exploit for CVE-2021-21974, targeting the OpenSLP service in VMware ESXi. The exploit leverages a heap overflow vulnerability to achieve remote code execution (RCE) by sending crafted SLP packets.
This repository contains a functional exploit for CVE-2021-21974, targeting a heap overflow vulnerability in VMware ESXi's OpenSLP service. The exploit demonstrates remote code execution (RCE) by leveraging heap manipulation and memory corruption techniques to achieve arbitrary command execution.
References (3)
Scores
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H