Webpentest

The issue is related to a slow HTTP POST denial-of-service vulnerability in the rhttpproxy service. A malicious actor with network access to ESXi can exploit this issue to create a denial-of-service condition by overwhelming the rhttpproxy service with multiple requests. This is due to errors in resource management.

The issue is related to improper implementation of URI normalization in the rhttproxy service used by vCenter Server. This allows a malicious actor with network access to port 443 on vCenter Server to exploit the issue and bypass proxy, leading to internal endpoints being accessed. The vulnerability is also described as an improper access control issue, which can be exploited by a remote attacker to bypass existing security restrictions.

The issue is related to an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure) of the vCenter Server. An authenticated VAMI user with network access to port 5480 on vCenter Server may exploit this issue to execute code on the underlying operating system that hosts vCenter Server. The vulnerability is associated with incorrect code generation management. Exploitation may allow a remote attacker to execute arbitrary code in the operating system.

The issue is related to insufficient input validation in the Analytics service of VMware vCenter Server and VMware Cloud Foundation, which can lead to a denial-of-service condition. Successful exploitation may allow an attacker to cause a denial-of-service on vCenter Server.

The vCenter Server contains multiple local privilege escalation issues due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance. The vulnerability is related to insecure management of privileges.

The vCenter Server contains a denial-of-service issue in the VAPI (vCenter API) service. A malicious actor with network access to port 5480 on vCenter Server may exploit this issue by sending a specially crafted jsonrpc message to create a denial of service condition. This is due to insufficient input validation in the VAPI service.

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file. Thousands of potentially vulnerable servers are accessible through the Internet and are at risk of attacks. There have been real-world incidents where this issue was exploited, including an attack on the European retail giant MediaMarkt, which resulted in a ransom demand of $240 million and the disruption of IT systems and store operations.

The vCenter Server contains an information disclosure issue due to an unauthenticated appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information. This is related to the vCenter Server Appliance Management Interface (VAMI) and is associated with insufficient control of the system's controlled area, allowing an attacker to obtain unauthorized access to protected information by sending a specially crafted HTTP request through port 443.

The issue is related to insufficient access control in the Analytics service of VMware vCenter Server, allowing an authenticated user with non-administrative privileges to potentially exploit it and gain access to sensitive information.

The issue is related to a denial-of-service condition in the VPXD service of the vCenter Server. A malicious actor with network access to port 443 may exploit this to cause excessive memory consumption, leading to a denial of service. This can be achieved by sending a specially crafted HTTP request through port 443.

The issue is related to a reverse proxy bypass due to incorrect handling of URI endpoints. A malicious actor with network access to port 443 on vCenter Server may exploit this to access restricted endpoints by sending a specially crafted HTTP request. This could allow unauthorized access to protected information.

The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information by sending a specially crafted HTTP request. This vulnerability is related to insufficient directory path checking in the vCenter Server Appliance Management Interface (VAMI), allowing unauthorized access to protected information.

The issue is related to insufficient authentication mechanisms for endpoints in the Content Library component of VMware vCenter Server. It allows a remote attacker to gain unauthorized access to protected information by sending a specially crafted HTTP request through port 443. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to perform unauthenticated VM network setting manipulation.

The issue is related to an uncontrolled resource consumption in the VAPI service of VMware vCenter Server. It can be exploited by a remote attacker to cause a denial of service by sending a specially crafted HTTP request through port 443. This can lead to excessive memory consumption by the VAPI service, resulting in a denial of service condition.

The vCenter Server contains an information disclosure issue in the VAPI (vCenter API) service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by sending a specially crafted json-rpc message to gain access to sensitive information. This is related to insufficient access control in the system, allowing an attacker to obtain unauthorized access to protected information by sending specially crafted JSON-RPC messages via port 443.

Name of the Vulnerable Software and Affected Versions: Jenkins Groovy Plugin versions 2.1 and earlier Description: A sandbox bypass issue exists that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. The issue is related to the `src/main/java/hudson/plugins/groovy/StringScriptSource.java` file. Recommendations: For Jenkins Groovy Plugin versions 2.1 and earlier, update to version 2.2 or later, which uses Script Security APIs to apply sandbox protection. As a temporary workaround, consider restricting access to the Jenkins master JVM to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Jenkins Email Extension Plugin versions 2.64 and earlier Description: A sandbox bypass issue exists that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM. The issue is related to files such as `pom.xml`, `ExtendedEmailPublisher.java`, `EmailExtScript.java`, `ScriptContent.java`, and `AbstractScriptTrigger.java`. Recommendations: For Jenkins Email Extension Plugin versions 2.64 and earlier, update to a version later than 2.64 to resolve the issue. As a temporary workaround, consider restricting Job/Configure permissions to minimize the risk of exploitation.

A sandbox bypass issue exists that allows attackers who can control pipeline scripts to execute arbitrary code on the Jenkins master JVM. The vulnerability is related to errors in handling input data during code syntax analysis in components such as pom.xml and CpsGroovyShell.java. This could enable a remote attacker to bypass sandbox restrictions and execute arbitrary code.

A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. The issue is related to errors in handling input data during code syntax analysis in the GroovySandbox.java and SecureGroovyScript.java components. This vulnerability can be exploited by a remote attacker to escape the isolated software environment and execute arbitrary code.