CVE-2021-22015
HIGHVMware Cloud Foundation 3.0-5.0 and vCenter Server - Local Privilege Escalation via Improper File Permissions
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2021-22015.
PoCs published by PenteraIO, h00die, Yuval Lazar, including Metasploit module exploits/linux/local/vcenter_java_wrapper_vmon_priv_esc.
AI-analyzed exploit summary The repository contains a bash script that scans for the presence of CVE-2021-22015 by checking if the 'cis' group has write access to a specific file and if any user in that group has shell access. It does not exploit the vulnerability but detects its presence.
Description
The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.
Exploits (2)
The repository contains a bash script that scans for the presence of CVE-2021-22015 by checking if the 'cis' group has write access to a specific file and if any user in that group has shell access. It does not exploit the vulnerability but detects its presence.
This Metasploit module exploits a privilege escalation vulnerability in VMware vCenter by modifying the /usr/lib/vmware-vmon/java-wrapper-vmon file, which is writable by the 'cis' group and executes as root upon service restart or host reboot. It backs up the original file, injects a payload, and attempts to restart the vmware-vmon service to trigger execution.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H