Arbitrary file write vulnerability in VMware vRealize Operations Manager

CVE-2021-21983

Summary

A security flaw has been identified in VMware vRealize Operations Manager that permits authenticated attackers with network access to exploit the API. This vulnerability enables them to write files to arbitrary locations on the underlying Photon operating system. With sufficient access, malicious actors might leverage this weakness to manipulate files, potentially leading to further exploits or unauthorized access within the system.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2021-21983
Created by Rapid7

CVE-2021-21983
Created by murataydemir

References