PT-2014-6245 · Zoho · Manageengine Desktop Central

Publicado 2014-10-21 · Atualizado 2020-01-17 · CVE-2014-5005

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90055

Description The issue allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate. This is a directory traversal vulnerability.

Recommendations For versions prior to 9 build 90055, update to version 9 build 90055 or later to resolve the issue. As a temporary workaround, consider restricting access to the statusUpdateServlet to minimize the risk of exploitation. Avoid using the fileName parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-5005

ZDI-15-006

Produtos afetados

Manageengine Desktop Central

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_statusupdate_upload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/34518 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Aug/88 · Exploit
• 🔥 https://exploit-db.com/exploits/34594 · Exploit
• 🔥 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc9_file_upload.txt · Exploit
• 🔥 http://exploit-db.com/exploits/34594 · Exploit
• https://manageengine.com/products/desktop-central/remote-code-execution.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5005 · Nota de Segurança
• http://osvdb.org/show/osvdb/110643 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-006 · Nota de Segurança