VMware vCenter vSAN Health Check Plugin Remote Code Execution Vulnerability
Table of Contents
Option 1: For vCenter Server Appliances
- Connect to the vCSA using an SSH session and root credentials.
- Backup the
/etc/vmware/vsphere-ui/compatibility-matrix.xml
file. -
Open the compatibility-matrix.xml file in a text editor:
-
Note: Content of an unedited file should look similar to the following:
-
To disable all plugins with disclosed vulnerabilities, add the following lines as shown below:
-
Note: These entries should be added between the
-->
and<!--
entries highlighted above.<PluginPackage id="com.vmware.vrops.install" status="incompatible"/> <PluginPackage id="com.vmware.vsphere.client.h5vsan" status="incompatible"/> <PluginPackage id="com.vmware.vrUi" status="incompatible"/> <PluginPackage id="com.vmware.vum.client" status="incompatible"/> <PluginPackage id="com.vmware.h4.vsphere.client" status="incompatible"/>
- The file should look like the following image:
- Save and close the compatibility-matrix.xml file.
- Stop and restart the
vsphere-ui
service using these commands:service-control --stop vsphere-ui service-control --start vsphere-ui
Option 2: For Windows-based vCenter Servers
- Use Remote Desktop to access the Windows-based vCenter Server.
- Take a backup of the
C:\ProgramData\VMware\vCenterServer\cfg\vsphere-ui\compatibility-matrix.xml
file. - Open the
compatibility-matrix.xml
file in a text editor:
-
To disable all plugins with disclosed vulnerabilities, add the following lines as shown below:
-
Note: These entries should be added between the
-->
and<!--
entries highlighted above<PluginPackage id="com.vmware.vrops.install" status="incompatible"/> <PluginPackage id="com.vmware.vsphere.client.h5vsan" status="incompatible"/> <PluginPackage id="com.vmware.vrUi" status="incompatible"/> <PluginPackage id="com.vmware.vum.client" status="incompatible"/> <PluginPackage id="com.vmware.h4.vsphere.client" status="incompatible"/>
- Save and close the file.
- In a Windows command prompt, stop and restart the vsphere-ui service using these commands:
C:\Program Files\VMware\vCenter Server\bin> service-control --stop vsphere-ui C:\Program Files\VMware\vCenter Server\bin> service-control --start vsphere-ui