Pentera Labs uncovered CVE-2021-22015, a local privilege escalation flaw in VMware vCenter affecting versions 6.5 to 7.0. The issue stems from the java-wrapper-vmon file, which runs with root privileges but was writable by members of the cis group. Attackers gaining shell access as a low-privileged cis user, such as through CVE-2021-21972, could insert malicious code into this file. Restarting vCenter services or the host would then execute the code as root, enabling full compromise, including ransomware deployment or data theft. VMware patched the flaw in September 2021, urging immediate updates as no workarounds exist.

Join for free to read