Sergey Gerasimov

The issue is related to a slow HTTP POST denial-of-service vulnerability in the rhttpproxy service. A malicious actor with network access to ESXi can exploit this issue to create a denial-of-service condition by overwhelming the rhttpproxy service with multiple requests. This is due to errors in resource management.

The issue is related to improper implementation of URI normalization in the rhttproxy service used by vCenter Server. This allows a malicious actor with network access to port 443 on vCenter Server to exploit the issue and bypass proxy, leading to internal endpoints being accessed. The vulnerability is also described as an improper access control issue, which can be exploited by a remote attacker to bypass existing security restrictions.

The issue is related to an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure) of the vCenter Server. An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server. The vulnerability is associated with incorrect code generation management. Exploitation may allow a remote attacker to execute arbitrary code in the operating system.

The vCenter Server contains a denial-of-service issue in the VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition. This is due to insufficient input validation in the VAPI service.

The issue is related to errors in privilege management in the VMware vSphere Life-cycle Manager module of the VMware vCenter Server virtual infrastructure management tool, which is part of the VMware Cloud Foundation virtualization platform. This can allow a remote attacker to delete arbitrary files. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non-critical files.

The vCenter Server contains multiple local privilege escalation issues due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance. The vulnerability is related to insecure management of privileges.

The issue is related to a reverse proxy bypass due to incorrect handling of URI endpoints. A malicious actor with network access to port 443 on vCenter Server may exploit this to access restricted endpoints by sending a specially crafted HTTP request. This could allow unauthorized access to protected information.

The vCenter Server contains an information disclosure issue due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information. This is related to the vCenter Server Appliance Management Interface (VAMI) and is associated with insufficient control of the system's controlled area, allowing an attacker to obtain unauthorized access to protected information by sending a specially crafted HTTP request through port 443.

The issue is related to an uncontrolled resource consumption in the VAPI service of VMware vCenter Server. It can be exploited by a remote attacker to cause a denial of service by sending a specially crafted HTTP request through port 443. This can lead to excessive memory consumption by the VAPI service, resulting in a denial of service condition.

The issue is related to insufficient authentication mechanisms for endpoints in the Content Library component of VMware vCenter Server. It allows a remote attacker to gain unauthorized access to protected information by sending a specially crafted HTTP request through port 443. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation.

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. Thousands of potentially vulnerable servers are accessible through the Internet and are at risk of attacks. There have been real-world incidents where this issue was exploited, including an attack on the European retail giant MediaMarkt, which resulted in a ransom demand of $240 million and the disruption of IT systems and store operations.

The vCenter Server contains an information disclosure issue in the VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information. This is related to insufficient access control in the system, allowing an attacker to obtain unauthorized access to protected information by sending specially crafted JSON-RPC messages via port 443.

The issue is related to insufficient access control in the Analytics service of VMware vCenter Server, allowing an authenticated user with non-administrative privileges to potentially exploit it and gain access to sensitive information.

The issue is related to a denial-of-service condition in the VPXD service of the vCenter Server. A malicious actor with network access to port 443 may exploit this to cause excessive memory consumption, leading to a denial of service. This can be achieved by sending a specially crafted HTTP request through port 443.