CVE-2021-21975
VMware Server Side Request Forgery in vRealize Operations Manager API
Description
CVE-2021-21975 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in VMware vRealize Operations Manager API that allows an unauthenticated attacker to steal administrative credentials. The flaw exists in vRealize Operations Manager API versions prior to 8.4 and can be exploited by any malicious actor with network access to the API endpoint. CISA has confirmed active exploitation of CVE-2021-21975 in the wild and has flagged it as known to be used in ransomware campaigns, significantly elevating the threat level. With an EPSS score of 94.39% (99.97th percentile), this VMware SSRF vulnerability has near-certain exploitation probability, demanding immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud foundation | 3.0; 3.0.1; 3.0.1.1; 3.5; 3.5.1; 3.7; 3.7.1; 3.7.2; 3.8; 3.8.1; 3.9; 3.9.1; 3.10; 4.0; 4.0.1 |
| vmware | vrealize operations manager | 7.0.0; 7.5.0; 8.0.0; 8.0.1; 8.1.0; 8.1.1; 8.2.0; 8.3.0 |
| vmware | vrealize suite lifecycle manager | 8.0; 8.0.1; 8.1; 8.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.vmware.com/security/advisories/VMSA-2021-0004.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21975(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery occurs when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to coerce the application to send requests to unexpected destinations. In the case of CVE-2021-21975, the SSRF vulnerability in VMware vRealize Operations Manager API enables attackers to forge server-side requests that access internal services and steal administrative credentials that would otherwise be protected by network access controls.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2021-21975 carries a CVSS 3.1 score of 7.5 (HIGH), indicating a serious threat to organizations running VMware vRealize Operations Manager. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it easily exploitable by any attacker with network access to the vRealize Operations Manager API. The primary impact is on confidentiality (rated HIGH), as successful exploitation allows the theft of administrative credentials, while integrity and availability remain unaffected. The EPSS score of 94.39% (99.97th percentile) indicates near-certain exploitation activity. Critically, CISA has identified this vulnerability as being used in ransomware campaigns, meaning exploitation can lead to credential theft followed by ransomware deployment across the target environment.
Exploit Maturity
CVE-2021-21975 has a well-documented exploit landscape with confirmed active exploitation. Public exploit code is available via Packet Storm Security, providing both SSRF exploitation and code execution capabilities. CISA has confirmed active exploitation in the wild by listing CVE-2021-21975 in its Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-02-01, and has additionally flagged it as known to be used in ransomware campaigns. The EPSS score of 94.39% (99.97th percentile) indicates near-certain exploitation activity, placing it among the most actively targeted VMware vulnerabilities.
Remediation
- Apply VMware patches immediately as required by CISA KEV directive. Upgrade vRealize Operations Manager to version 8.4 or later as described in VMware Security Advisory VMSA-2021-0004. Also patch affected VMware Cloud Foundation and vRealize Suite Lifecycle Manager instances.
- Verify all affected products are updated, including VMware vRealize Operations Manager (versions 7.0.0 through 8.3.0), VMware Cloud Foundation (versions 3.x and 4.x), and VMware vRealize Suite Lifecycle Manager (versions 8.0 through 8.2).
- Implement SSRF-specific mitigations by restricting outbound network access from vRealize Operations Manager servers. Block requests to internal IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x, 169.254.x.x) from the application layer, and segment the vRealize Operations Manager network to limit lateral movement potential.
- Rotate all administrative credentials that may have been exposed through the SSRF vulnerability. This includes vRealize Operations Manager admin accounts, VMware vCenter credentials, and any other credentials accessible from the internal network that vRealize Operations Manager can reach.
- Monitor for ransomware indicators given the confirmed use in ransomware campaigns. Review network logs for unusual outbound connections from vRealize Operations Manager, check for unauthorized credential usage, and implement enhanced monitoring on systems accessible from the vRealize Operations Manager network.
Technical Details
CVE-2021-21975 is a Server-Side Request Forgery (SSRF) vulnerability in the VMware vRealize Operations Manager API that allows attackers to forge requests from the server to internal resources. The SSRF weakness (CWE-918) manifests because the API processes user-supplied URLs without proper validation, enabling attackers to redirect server-side requests to internal services and extract administrative credentials. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network-based remote exploitation with low complexity and no authentication required, with a high confidentiality impact reflecting the ability to steal sensitive credentials. The vulnerability affects multiple VMware products including vRealize Operations Manager versions 7.0.0 through 8.3.0, Cloud Foundation 3.x and 4.x, and vRealize Suite Lifecycle Manager 8.0 through 8.2, broadening the attack surface across VMware-centric enterprise environments.
Frequently Asked Questions
Is CVE-2021-21975 being actively exploited?
Yes. CVE-2021-21975 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Additionally, CISA has flagged this vulnerability as known to be used in ransomware campaigns. The EPSS score of 94.39% indicates near-certain exploitation activity.
What products are affected by CVE-2021-21975?
CVE-2021-21975 affects VMware vRealize Operations Manager versions 7.0.0 through 8.3.0, VMware Cloud Foundation versions 3.x and 4.x (including 3.0 through 4.0.1), and VMware vRealize Suite Lifecycle Manager versions 8.0 through 8.2. All instances of these products should be patched.
How do I fix CVE-2021-21975?
Upgrade VMware vRealize Operations Manager to version 8.4 or later as described in VMware Security Advisory VMSA-2021-0004. Also apply patches to affected Cloud Foundation and vRealize Suite Lifecycle Manager instances. Rotate any administrative credentials that may have been compromised.
How severe is CVE-2021-21975?
CVE-2021-21975 has a CVSS 3.1 score of 7.5 (HIGH) and an EPSS score of 94.39% (99.97th percentile). The vulnerability is particularly dangerous because it enables credential theft without authentication and has been confirmed in ransomware campaigns, making it a top-priority remediation target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.