Webserver POST to /ui/vropspluginui/rest/services/uploadova indicates CVE-2021-21972 VMware vSphere exploitation

Alerts on POST requests to the uploadova endpoint tied to CVE-2021-21972 vSphere exploitation.

FreeUnreviewedSigmahighv1

webserver-post-to-ui-vropspluginui-rest-services-uploadova-indicates-cve-2021-21-179ed852

title: Webserver POST to /ui/vropspluginui/rest/services/uploadova indicates CVE-2021-21972 VMware vSphere exploitation
id: 078d0592-95df-40c1-9557-073521143500
status: test
description: This rule flags webserver requests where the HTTP method is POST and the URL query matches /ui/vropspluginui/rest/services/uploadova, which is associated with exploitation activity for CVE-2021-21972. Attackers may use this endpoint to perform unauthenticated or scripted interactions that lead to remote code execution. The detection relies on webserver HTTP telemetry capturing request method and URI query path.
references:
  - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
  - https://f5.pm/go-59627.html
  - https://swarm.ptsecurity.com/unauth-rce-vmware
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-21972/web_cve_2021_21972_vsphere_unauth_rce_exploit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-02-24
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-21972
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query: /ui/vropspluginui/rest/services/uploadova
  condition: selection
falsepositives:
  - OVA uploads to your VSphere appliance
level: high
license: DRL-1.1
related:
  - id: 179ed852-0f9b-4009-93a7-68475910fd86
    type: derived

What it detects

This rule flags webserver requests where the HTTP method is POST and the URL query matches /ui/vropspluginui/rest/services/uploadova, which is associated with exploitation activity for CVE-2021-21972. Attackers may use this endpoint to perform unauthenticated or scripted interactions that lead to remote code execution. The detection relies on webserver HTTP telemetry capturing request method and URI query path.

Known false positives

OVA uploads to your VSphere appliance

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.