Horizon3.ai
Horizon3.ai

VMware vCenter vROPS Plugin Remote Code Execution Vulnerability

by | Jul 21, 2021 | Fix Actions

Table of Contents

Option 1: Upgrade your vCenter Instance

Upgrade the major release version to a version at or above as indicated below:

  • Version 7.0 – Patched 7.0 U1c or later
  • Version 6.7 – Patched 6.7 U3l or later
  • Version 6.5 – Patched 6.5 U3n or later

Option 2: Disable Plugins on Virtual Server Appliance Deployments

Important: Plugins must be set to “incompatible.” Disabling a plugin from within the UI does not prevent exploitation. The following actions must be performed on both the active and passive nodes in environments running vCenter High Availability (VCHA).

  1. Connect to the vCSA using an SSH session and root credentials.
  2. Backup the /etc/vmware/vsphere-ui/compatibility-matrix.xml file:
cp -v /etc/vmware/vsphere-ui/compatibility-matrix.xml /etc/vmware/vsphere-ui/compatibility-matrix.xml.backup
  1. Open the compatibility-matrix.xml file in a text editor.
  • NOTE: Contents of this file looks like below: Example content
  1. Add the following line in between the WHITE LIST and BLACK LIST blocks:
<PluginPackage id="com.vmware.vrops.install" status="incompatible"/>
  • NOTE: The file should like below: Final edit
  1. Save and close the compatibility-matrix.xml file.
  2. Stop and restart the vsphere-ui service using the commands:
service-control --stop vsphere-ui.
service-control --start vsphere-ui.

Option 3: Disable Plugins on Windows-based vCenter Server Deployments

  1. Use Remote Desktop to access the Windows based vCenter Server.
  2. Take a backup of the C:\ProgramData\VMware\vCenterServer\cfg\vsphere-ui\compatibility-matrix.xml file.
  3. Content of this file looks like below: file contents
  4. Add the following line in between the WHITE LIST and BLACK LIST blocks:
<PluginPackage id="com.vmware.vrops.install" status="incompatible"/>
  • NOTE: The file should look like below: final edit
  1. Stop and restart the vsphere-ui service using the commands:
C:\Program Files\VMware\vCenter Server\bin> service-control --stop vsphere-ui
C:\Program Files\VMware\vCenter Server\bin> service-control --start vsphere-ui

Validation

  1. Navigate to the https://{your-vcenter-hostname}/ui/vropspluginui/rest/services/checkmobregister. This page should display a 404/Not Found error, as shown below: example 404
  2. From the vSphere Client (HTML 5), the VMware vROPS Client plugin can be seen as “incompatible” under Administration > Solutions > Client Plugins as shown below: example plugins list
  3. This confirms that the vRops Client Plugin is set to “Incompatible”.