VMware vCenter Server file upload exploitation attempt (CVE-2021-22005) via web POST telemetry endpoint

title: VMware vCenter Server file upload exploitation attempt (CVE-2021-22005) via web POST telemetry endpoint
id: e1b97df2-1c82-4b44-89c3-fa8189f60e5d
status: test
description: This rule flags web requests where the HTTP method is POST and the requested query string contains the path associated with vCenter telemetry file upload handling (/analytics/telemetry/ph/api/hyper/send?). Attackers can use this file upload weakness to achieve initial access, making targeted HTTP telemetry endpoint activity a useful indicator. Detection relies on webserver request telemetry capturing HTTP method and URI query content.
references:
  - https://kb.vmware.com/s/article/85717
  - https://www.tenable.com/blog/cve-2021-22005-critical-file-upload-vulnerability-in-vmware-vcenter-server
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-22005/web_cve_2021_22005_vmware_file_upload.yml
author: Sittikorn S, Huntrule Team
date: 2021-09-24
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-22005
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains: /analytics/telemetry/ph/api/hyper/send?
  condition: selection
falsepositives:
  - Vulnerability Scanning
level: high
license: DRL-1.1
related:
  - id: b014ea07-8ea0-4859-b517-50a4e5b7ecec
    type: derived