Multiple Vulnerabilities IBM Cloud Pak System

1) Input validation error

EUVDB-ID: #VU53595

Risk: Critical

CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-21985

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the Virtual SAN Health Check plug-in, which is enabled by default. A remote non-authenticated attacker can send a specially crafted HTTP request to the vSphere Client available at port 443/tcp and execute arbitrary commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Improper Authentication

EUVDB-ID: #VU53596

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21986

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests to the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A remote non-authenticated attacker can bypass authentication process and gain unauthorized access to the application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU56791

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21991

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way the vCenter Server handles session tokens. A local user can escalate privileges to Administrator on the vSphere Client (HTML5) or vCenter Server vSphere Web Client (FLEX/Flash).

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU56792

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21992

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when parsing XML data. A remote user can pass specially crafted XML data to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU56793

Risk: Medium

CVSSv3.1: 4.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-21993

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper Authorization

EUVDB-ID: #VU56795

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-22006

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exist due to improper URI handling in reverse proxy. A remote non-authenticate attacker can send a specially crafted HTTP request to port 443/TCP and access restricted endpoints.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

7) Information disclosure

EUVDB-ID: #VU56797

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22008

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in VAPI (vCenter API) service. A remote attacker with access to port 443/TCP can gain unauthorized access to sensitive information on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource exhaustion

EUVDB-ID: #VU56798

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22009

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the VAPI (vCenter API) service. A remote attacker can send specially crafted HTTP request to port 443/TCP and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource exhaustion

EUVDB-ID: #VU56799

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22010

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the VPXD (Virtual Provisioning X Daemon) service. A remote attacker can send a secially crafted HTTP request to port 443/TCP and consume all available memory resources.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper Authentication

EUVDB-ID: #VU56800

Risk: Medium

CVSSv3.1: 6.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22011

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication for an API endpoint in vCenter Server Content Library. A remote non-authenticated attacker with access to port 443/TCP can gain unauthorized access to the system and perform unauthenticated VM network setting manipulation.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Cross-site scripting

EUVDB-ID: #VU56805

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22016

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper Authorization

EUVDB-ID: #VU56806

Risk: Medium

CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-22017

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exist due to improper implementation of URI normalization in rhttpproxy. A remote non-authenticate attacker can request a specially crafted URL, bypass rhttpproxy and access internal endpoints.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Cloud Pak System: 2.3.0.1 - 2.3.3.3 iFix 1

CPE2.3

External links

http://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-vmware-vcenter-affect-ibm-cloud-pak-system-2/
http://www.ibm.com/support/pages/node/6507111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

Risk	Critical
Patch available	YES
Number of vulnerabilities	12
CVE-ID	CVE-2021-21985 CVE-2021-21986 CVE-2021-21991 CVE-2021-21992 CVE-2021-21993 CVE-2021-22006 CVE-2021-22008 CVE-2021-22009 CVE-2021-22010 CVE-2021-22011 CVE-2021-22016 CVE-2021-22017
CWE-ID	CWE-20 CWE-287 CWE-264 CWE-918 CWE-285 CWE-200 CWE-400 CWE-79
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Public exploit code for vulnerability #6 is available. Vulnerability #12 is being exploited in the wild.
Vulnerable software Subscribe	IBM Cloud Pak System Server applications / Server solutions for antivurus protection
Vendor	IBM Corporation