Experts shared PoC exploit code for RCE in Zoho ManageEngine ADAudit Plus tool
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-10189 | Unauthenticated RCE in Zoho ManageEngine Desktop Central Zoho ManageEngine Desktop Central contains a file upload vulnerability (CWE-502, deserialization of untrusted data) that can be exploited without authentication. A remote attacker sends crafted upload requests to the affected application, which accepts and processes the uploaded content without any credentials, resulting in execution of attacker-controlled code. Successful exploitation yields remote code execution on the server hosting Desktop Central, giving the attacker a foothold on an endpoint-management system that typically has broad reach into a corporate network. Any organization running the affected Zoho ManageEngine product is exposed, and exploitability does not depend on user interaction or credentials. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating known exploitation in the wild, and EPSS assigns a 99.9% probability of exploitation within 30 days; specific exploited versions are not stated in the available data. Do: Apply updates per Zoho/ManageEngine vendor instructions immediately, as the CISA KEV required action specifies. Restrict internet exposure of the Desktop Central server and audit it for signs of compromise (unexpected processes, webshells, outbound connections) since unauthenticated RCE has been exploited in the wild. Check that any exposed instances are patched before treating network access as safe. | 9.8 | 100% | KEV PoC ×3 |
| largetens of thousands of internet-exposed Desktop Central servers (order of magnitude 10k-100k) | |
| CVE-2022-28219 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. NVD description · AI analysis pending | 9.8 | 97% | PoC ×2 |
| — |
Full article635 words · extracted from securityaffairs.com · click to collapse
Researchers shared technical details and proof-of-concept exploit code for the CVE-2022-28219 flaw in Zoho ManageEngine ADAudit Plus tool.
Security researchers from Horizon3.ai have published technical details and proof-of-concept exploit code for a critical vulnerability, tracked as CVE-2022-28219 (CVSS 9.8 out of 10), in the Zoho ManageEngine ADAudit Plus tool.
The tool allows monitoring activities of Active Directory and produces alerts and reporting for one or more desired Active Directory change events. The tool is very attractive to threat actors because of the privileged access they have to Active Directory.
The unauthenticated remote code execution vulnerability was discovered by security researcher Naveen Sunkavally at Horizon3.ai and addressed by the vendor in March.
The issue was discovered while investigating an endpoint managed by the CewolfRenderer servlet in the third-party Cewolf charting library.
The vulnerability includes three issues: untrusted Java deserialization, path traversal, and a blind XML External Entities (XXE) injection.
“One of the first things that stood out, and we were surprised to see, was the presence of a /cewolf endpoint handled by the CewolfRenderer servlet in the third-party Cewolf charting library. This is the same vulnerable endpoint from CVE-2020-10189, reported by @steventseeley against ManageEngine Desktop Central.” reads the post published by the experts. “The FileStorage class in this library was abused for remote code execution via untrusted Java deserialization.”
The analysis of the library code revealed that the software deserializes untrusted code and doesn’t sanitize input file paths. The experts were able to use the img parameter to deserialize a Java payload anywhere on the disk.
Once achieved the remote code execution capability, the experts focus on discovering a way to upload a Java payload anywhere on disk. The experts noticed a feature in the ADAudit Plus which collects security events from agents running on other machines in the domain. The experts discovered that some of the endpoints that agents use to upload events to ADAudit Plus were unauthenticated
“One of the features of ADAudit Plus is the ability to collect security events from agents running on other machines in the domain. To our surprise, we found that a few of the endpoints that agents use to upload events to ADAudit Plus were unauthenticated. This gave us a large attack surface to work with because there’s a lot of business logic that was written to process these events. While looking for a file upload vector, we found a path to trigger a blind XXE vulnerability in the ProcessTrackingListener class, which handles events containing Windows scheduled task XML content.” continues the analysis. “This class was using the dangerous default version of Java’s DocumentBuilderFactory class, which permits external entity resolution and is vulnerable to XXE injection.”
The experts discovered a blind XXE vulnerability in the ProcessTrackingListener class, they noticed that Blind XXE vulnerabilities in Java are usually hard to exploit, but in this case, they were aided by the old Java runtime bundled with ADAudit Plus. By default ADAudit Plus ships with Java 8u051.
The old Java runtime allowed the researchers to exploit the blind XXE to exfiltrate files over FTP, get directory listings over FTP, and upload files.
The experts demonstrated how to exploit CVE-2022-28219 in ManageEngine ADAudit Plus to execute the calculator app.
The experts discovered XXE vulnerabilities in Java and in Windows that can be exploited to capture and relay the NTLM hashes of the user account under which the application is running. The root cause is that the Java HTTP client will attempt to authenticate over NTLM if it connects to a server requiring NTLM to authenticate.
“This is especially useful for an attacker if the ADAudit Plus application is running under a privileged account.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Zoho ManageEngine ADAudit Plus)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/132797/hacking/zoho-manageengine-adaudit-plus-rce.html