---
title: "vCenter vSAN Health RCE (CVE-2021-21985)"
canonical: https://trickest.com/library/cve-2021-21985-vcenter-vsan-health-plugin-rce
description: "Flag VMware vCenter hosts for CVE-2021-21985 by reading version and build from GET /sdk. Fixed only at 7.0 U2b build 17958471. No vSAN RCE."
---

# vCenter vSAN Health RCE (CVE-2021-21985)

## Overview

This workflow finds VMware vCenter Server and sorts each host by whether its version and build fall below the single CVE-2021-21985 FIXED release in the graph. CVE-2021-21985 is remote code execution through the vSAN Health Check plug-in. This check never hits a vSAN Health URL and never sends an SSRF or RCE payload. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/sdk` only, fingerprints vCenter from markers in that response, parses the `VMware vCenter Server` version and `build-` number, and compares the tuple to FIXED only at 7.0 U2b build 17958471. There is no FIXED_BRANCHES table, so 6.5 and 6.7 builds that parse below that tuple are flagged by the same rule. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no confirm step.

Run it on a schedule when management planes change. A 7.0 appliance that never took U2b is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/sdk` on each host and fingerprint vCenter from response markers such as `VMware vCenter Server`, `RetrieveServiceContentResponse`, `urn:vim25`, and `build-`.
3. Parse the version and build string and compare the tuple to the single FIXED release 7.0.2 build 17958471. No FIXED_BRANCHES table.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether vCenter was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/sdk` only. No vSAN Health plug-in invoke and no SSRF probe.

## Sample output

The records below are illustrative and do not come from a real run. They show one vCenter host below the CVE-2021-21985 FIXED release, one at or above it, and one host that is not the product.

```jsonl
{"url": "https://vc.example.com", "is_product": true, "product_version": "7.0.2.17000000", "vulnerable": true, "detail": "below fixed release 7.0 U2b build 17958471"}
{"url": "https://vc.example.org", "is_product": true, "product_version": "7.0.2.17958471", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as VMware vCenter Server"}
```

```json
{"cve": "CVE-2021-21985", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which vCenter versions does this flag?

Hosts whose parsed version and build tuple fall below the single FIXED release 7.0 U2b (build 17958471). There is no branch table, so 6.5 and 6.7 builds that parse below that tuple are flagged the same way. The compare uses the string the `/sdk` response itself served.

### Does an affected row mean the vSAN Health plug-in ran?

No. The check only GETs `/sdk` and reads version and build. It does not hit a vSAN Health endpoint and it does not confirm RCE or SSRF.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of `/sdk`. It does not log in or invoke a plug-in.

### Does the check need credentials?

No. It fingerprints the public `/sdk` surface the way an external scanner would.

### What is CVE-2021-21985?

Remote code execution in VMware vCenter Server through the vSAN Health Check plug-in. This workflow maps hosts to that CVE by version and build exposure only against a single FIXED release.

## Related workflows

- [vCenter plugin RCE (CVE-2021-21972)](/library/cve-2021-21972-vcenter-vsphere-client-plugin-rce). Reach for it when you need the earlier vSphere Client plugin upload fingerprint.
- [vCenter file upload RCE (CVE-2021-22005)](/library/cve-2021-22005-vcenter-file-upload-rce). Reach for it when you need the analytics file-upload version gate on the same fleet.
- [VMware vCenter plugin SSRF (CVE-2021-21973)](/library/cve-2021-21973-vcenter-plugin-ssrf). Reach for it when the next vCenter flag is plugin SSRF, not vSAN Health.

---
_Markdown source of https://trickest.com/library/cve-2021-21985-vcenter-vsan-health-plugin-rce._