Determined APT is exploiting ManageEngine ServiceDesk Plus vulnerability (CVE-2021-44077)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-33617 | Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid. NVD description · AI analysis pending | 5.3 | 2% | PoC |
| — | |
| CVE-2021-44077 | Unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus and SupportCenter Plus CVE-2021-44077 is a critical (CVSS 9.8) unauthenticated remote code execution flaw in Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus, rooted in missing authentication (CWE-306) on /RestAPI servlet URLs, specifically the ImportTechnicians action in the Struts configuration. A remote attacker can trigger it by sending crafted unauthenticated requests to the RestAPI endpoints, requiring no credentials or user interaction. Successful exploitation yields arbitrary code execution in the context of the application, giving attackers full control of the help desk server as a foothold for further network compromise. Any organization running affected versions before ServiceDesk Plus 11306, ServiceDesk Plus MSP 10530, or SupportCenter Plus 11014 is affected, particularly where the console is internet-facing. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2021-12-01, carries a 93.3% EPSS probability of near-term exploitation, and headlines point to active APT campaigns and mass exploitation against ManageEngine ServiceDesk deployments. Do: Upgrade to the fixed releases: ServiceDesk Plus 11306 or later, ServiceDesk Plus MSP 10530 or later, and SupportCenter Plus 11014 or later, per vendor instructions (CISA KEV requires this action). Until patched, restrict or firewall internet access to /RestAPI endpoints, and review access logs for unauthenticated requests to the ImportTechnicians action along with unexpected processes, files, or webshells on the server. Given the 93.3% EPSS score, active APT exploitation, and concurrent zero-day activity against other ManageEngine products, treat exposed instances as potentially compromised and hunt for post-exploitation activity. | 9.8 | 93% | KEV PoC |
| largetens of thousands of on-prem help desk deployments worldwide, with thousands of instances directly internet-exposed (estimate) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | passwordmanagerpromsp.com | to note that on Nov. 9, we observed the actor connecting to passwordmanagerpromsp[.]com . This domain is associated with another ManageEngine pro |
Full article632 words · extracted from helpnetsecurity.com · click to collapse
An APT group is leveraging a critical vulnerability (CVE-2021-44077) in Zoho ManageEngine ServiceDesk Plus to compromise organizations in a variety of sectors, including defense and tech.
“Successful exploitation of the vulnerability allows an attacker to upload executable files and place webshells, which enable the adversary to conduct post-exploitation activities, such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files,” the Cybersecurity and Infrastructure Security Agency (CISA) warns.
About CVE-2021-44077
CVE-2021-44077 is an authentication bypass vulnerability that affects ManageEngine ServiceDesk Plus (on-premises) installations using versions 11305 and earlier.
The source of the vulnerability is an improper security configuration process used in ServiceDesk Plus, and it allows attackers to gain unauthorized access to the application’s data through a few of its application URLs.
“To do so, an attacker has to manipulate any vulnerable application URL path from the assets module with a proper character set replacement,” the company explained.
“This URL can bypass the authentication process and fetch the required data for the attacker, allowing the attacker to gain unauthorized access to user data or carry out subsequent attacks.”
The vulnerability has been patched by ManageEngine (a Zoho subsidiary) on September 16, 2021, by releasing version 11306.
The attacks
The attacks exploiting CVE-2021-44077 have been happening for a while.
Palo Alto Networks‘ Unit 42 has tied the activity to a “persistent and determined APT actor” that has first used a zero-day vulnerability in ADSelfService in August and September, then switched to exploiting another vulnerability (CVE-2021-44077) affecting the same software in September and October, and is now (since late October) leveraging CVE-2021-44077 in the ServiceDesk Plus software.
Since there is no publicly available proof of concept exploit code for CVE-2021-44077, the researchers posit that the APT actor developed the exploit code for their attacks.
“Upon exploitation, the actor has been observed uploading a new dropper to victim systems. Similar to the previous tactics used against the ADSelfService software, this dropper deploys a Godzilla webshell which provides the actor with further access to and persistence in compromised systems,” they shared.
“Over the past three months, at least 13 organizations across the technology, energy, healthcare, education, finance and defense industries have been compromised [by this APT]. Of the four new victims, two were compromised through vulnerable ADSelfService Plus servers while two were compromised through ServiceDesk Plus software. We anticipate that this number will climb as the actor continues to conduct reconnaissance activities against these industries and others, including infrastructure associated with five U.S. states.”
Mitigation and remediation
Unit 42’s scanning for internet-facing instances of ManageEngine ServiceDesk Plus has revealed over 4,700 installations, 2,900 of which are vulnerable to exploitation. Some 600 of these are located in the U.S.
The researchers have shared technical details and IoCs of these latest attacks exploiting CVE-2021-44077, as well as advice for organizations on how to defend themselves.
The CISA advisory also offers similar information, as well as network indicators, TTPs, Yara rules and mitigation advice, and Zoho has provided additional details and a downloadable exploit detection tool companies can use to run a quick scan and discover any compromises in their installation.
Finally, Palo Alto’s researchers have offered an additional warning:
“In continuing to track this actor’s activities, we believe it is also important to note that on Nov. 9, we observed the actor connecting to passwordmanagerpromsp[.]com. This domain is associated with another ManageEngine product that provides Managed Service Providers (MSPs) with the ability to manage passwords across multiple customers in a single instance. Earlier this year, Zoho released a patch for CVE-2021-33617 affecting this product. While we have not seen any exploitation attempts to date, given the actor’s emerging pattern of targeting ManageEngine products and the actor’s interest in this third product, we highly recommend organizations apply the relevant patches.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/12/03/cve-2021-44077/