In a not entirely unexpected development, threat actors have started looking for internet-exposed VMware vCenter servers whose admins haven’t yet patched them against the critical arbitrary file upload vulnerability that was disclosed yesterday.
The critical security flaw, tracked as CVE-2021-22005 impacts VMware’s flagship vCenter Server deployments, and could help facilitate remote code execution (RCE) attacks from unauthenticated attackers without requiring user interaction.
“In this era of ransomware it is safest to assume that an attacker is already inside your network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible," warned Bob Plankers, Technical Marketing Architect at VMware yesterday as he urged vCenter Server admins to apply the patches without delay.
- These are the best ransomware protection tools
- Protect your devices with these best antivirus software
- We've put together a list of the best endpoint protection software
It seems the threat actors were more attentive, and it wasn’t long until the honeypots of threat intelligence company Bad Packets were scanned by malicious users looking for unpatched vCenter Servers.
Just a matter of time
Bad Packets later added that the malicious scans of its honeypots revealed that they were based on the workaround information provided by VMware for customers who couldn't immediately patch their appliances.
Sharing the development, BleepingComputer points out that this isn’t the first time threat actors have taken advantage of an admin’s laxity in patching their vCenter Servers to scan for and attack them soon after a vulnerability is disclosed.
In fact, there have been a couple of similar incidents this year alone, first in February (based on (based on CVE-2021-21972), and then in May (based on CVE-2021-21985).
The only saving grace with CVE-2021-22005, at least for now, is that unlike the previously mentioned vulnerabilities, security researchers haven’t yet caught hold of any exploit code that could capitalize on the bug.
However, since threat actors are actively scanning for vulnerable servers, chances are they already have a working exploit, or one that’s close to completion. In either case, the activity should be enough to convince admins to drop everything and patch their exposed vCenter Servers immediately.
- Here’s our roundup of the best patch management tools
Via BleepingComputer
