Nation-state actors are exploiting Zoho zero-day CVE-2021
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-44515 | Authentication Bypass Leading to RCE in Zoho ManageEngine Desktop Central CVE-2021-44515 is an authentication bypass in Zoho ManageEngine Desktop Central and Desktop Central MSP that allows an unauthenticated attacker to execute arbitrary code on the central management server. It is triggered by sending crafted requests to the Desktop Central server without valid credentials, bypassing the login entirely. Successful exploitation yields code execution on the management server, which typically holds broad credentials and can push commands and agents to every managed endpoint, making it a strong foothold for further network compromise. Any organization running an on-premises Desktop Central or Desktop Central MSP server is affected, particularly where the server is internet-exposed. The flaw was under active exploitation when disclosed in December 2021: CISA added it to the KEV on 2021-12-10, EPSS shows a 99.9% 30-day exploitation probability, and no public PoC is known. Do: Upgrade Desktop Central and Desktop Central MSP to build 10.1.2228.11 or later per ManageEngine's advisory, verifying the running build on the server's About page. Restrict internet access to the Desktop Central web console (default ports 8020/8383) and review server logs for unauthenticated access or unexpected code execution. Because a compromised management server often holds domain-level credentials, rotate credentials stored on or used by the server and watch managed endpoints for signs of follow-on compromise. | 9.8 | 100% | KEV PoC |
| largetens of thousands of on-prem server deployments, aggregating millions of managed endpoints via MSP deployments |
Full article329 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 20, 2021
The FBI warns that zero-day flaw in Zoho’s ManageEngine Desktop Central has been under active exploitation by nation-state actors since October.
The Federal Bureau of Investigation (FBI) revealed that the critical CVE-2021-44515 zero-day vulnerability in Zoho’s ManageEngine Desktop Central has been under active exploitation by nation-state actors since at least October.
The CVE-2021-44515 flaw is an authentication bypass vulnerability in ManageEngine Desktop Central software that can be exploited by attackers to bypass authentication and execute arbitrary code on Desktop Central servers.
“Since at least late October 2021, APT actors have been actively exploiting a zero-day, now identified as CVE-2021-44515, on ManageEngine Desktop Central servers.” reads the flash alert published by the FBI. “The APT actors were observed compromising Desktop Central servers, dropping a webshell that overrides a legitimate function of Desktop Central, downloading post-exploitation tools, enumerating domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials.”
Zoho addressed the flaw early this month and CISA added CVE-2021-44515 to the Known Exploited Vulnerabilities Catalog ordering federal agencies to address it before Christmas,
Querying the Shodan search engine for instances of ManageEngine Desktop Central exposed online, we can find more that 2980 systems.
The Flash alert includes Indicators of Compromise (IoCs) and Yara rules for these attacks along with Tactics, Techniques, and Procedures and mitigations.
“Organizations that identify any activity related to these IOCs within their networks should take action immediately. Zoho released a ManageEngine Desktop Central Security Advisory for the newly identified vulnerability CVE-2021-44515 on December 3, 2021:”
Zoho also provided the following vulnerable build numbers for ManageEngine Desktop Central
customers:
For Enterprise Customers:
For builds 10.1.2127.17 and below, upgrade to 10.1.2127.18
For builds 10.1.2128.0 to 10.1.2137.2, upgrade to 10.1.2137.3
For MSP Customers:
For builds 10.1.2127.17 and below, upgrade to 10.1.2127.18 For builds 10.1.2128.0 to 10.1.2137.2, upgrade to 10.1.2137.3
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Zoho)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/125821/hacking/zoho-zero-day-cve-2021-44515-fbi-alert.html