vCenter Server critical vulnerability CVE-2021-22005 and vCenter Server Security best practices

VMware recently released news of a new nasty security bug affecting vCenter Server. It allows an attacker with only network access to port 443 to upload specially crafted malicious code to vCenter and run arbitrary commands. It is already in the wild. What is this new vulnerability? How can organizations protect themselves?

Also, what are some vCenter Server security best practices that can help organizations secure their vCenter Servers? There are three I talk about in the video. These are:

- Keep vCenter Server updates
- Network segmentation
- Credentials segmentation

Applying vCenter Server updates - why is this important?

How does network segmentation help with vCenter Server security threats? What tools can you make use of if you can't move vCenter Server to a separate management network?

Why is thinking about your credentials important? How can you segment your credentials?

Links relevant to the video:

If you can't use the VAMI interface, learn how to manually patch vCenter Server here:

[albertobarbieri]

Do you know if there is any public exploit for this CVE? I'm doing a VAPT for my company and I think the version is vulnerable, but I would like to give a POC

[seths]

good info...patched my appliances earlier this week 😂