Code Injection in VMware Cloud Director

This repository contains a proof-of-concept exploit (exploit.py) for CVE-2020-3956, a remote code execution vulnerability in VMware vCloud Director. The exploit targets an expression injection flaw in the handling of the SMTP host field within the administrative API. By authenticating with valid credentials, the attacker can inject a crafted Java expression as the SMTP host, which is then evaluated by the server, leading to arbitrary command execution. The exploit is implemented in Python and requires the attacker to supply the target URL, username, and password. The README provides a brief description and references a technical advisory. The main code file, exploit.py, handles authentication, version detection, and payload delivery via the API. The exploit is operational and demonstrates real-world impact, but is not weaponized for mass exploitation. The main attack vector is network-based, targeting the vCloud Director administrative interface. Several fingerprintable endpoints are present, including the API paths used for authentication and email settings manipulation.