Saturday, December 2, 2023

VMware vCenter Server Flaw Let Attacker Exploit to Perform Elevate Privileges Attack

There has finally been a patch released by VMware for an affected version of vCenter Server’s IWA mechanism, eight months after a high-severity privilege escalation vulnerability was disclosed.

CrowdStrike Security’s Yaron Zinar and Sagi Sheinfeld reported the vulnerability and it has been tracked as CVE-2021-22048 on their respective systems. 

It also affects the hybrid cloud platform VMware’s Cloud Foundation as well, along with the IWA mechanism built into the vCenter Server.

An attacker can elevate privileges to a higher privileged group by successfully exploiting this vulnerability on unpatched vCenter Server deployments that do not require administrative access in order to execute malicious code.

Flaw profile

  • CVE ID: CVE-2021-22048
  • CVSS Score: 7.1
  • Advisory ID: VMSA-2021-0025.2
  • Summary: The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.
  • Issue Date: 2021-11-10
  • Updated On: 2022-07-12

Products impacted

Here below we have mentioned all the products that are impacted by this security flaw:-

  • VMware vCenter Server (vCenter Server)
  • VMware Cloud Foundation (Cloud Foundation)

This bug has been rated critical by VMware, which means it is in the range of severity for a critical bug. It means that the data of a user is compromised in a completely unreliable way due to authorized attacks or user assistance, which leads to a complete compromise of data integrity or confidentiality.

Since there are multiple versions of vCenter Server that are affected by this vulnerability, that’s why VMware has released update 3f for vCenter Server 7.0.


Since VMware’s security advisory was first published on November 10th, 2021, eight months ago, the company has provided a workaround to remove the attack vector.

VMware’s knowledgebase article claims that if an attack is attempted on Integrated Windows Authentication (IWA), administrators are advised to switch to Active Directory over LDAPs authentication or Identity Provider Federation for AD FS (vSphere 7.0 only) in order to prevent such attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles