PT-2014-6245 · Zoho · Manageengine Desktop Central

Published 2014-10-21 · Updated 2020-01-17 · CVE-2014-5005

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90055

Description The issue allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate. This is a directory traversal vulnerability.

Recommendations For versions prior to 9 build 90055, update to version 9 build 90055 or later to resolve the issue. As a temporary workaround, consider restricting access to the statusUpdateServlet to minimize the risk of exploitation. Avoid using the fileName parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-5005

ZDI-15-006

Affected Products

Manageengine Desktop Central

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_statusupdate_upload.rb · Exploit
• 🔥 https://exploit-db.com/exploits/34518 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Aug/88 · Exploit
• 🔥 https://exploit-db.com/exploits/34594 · Exploit
• 🔥 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc9_file_upload.txt · Exploit
• 🔥 http://exploit-db.com/exploits/34594 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5005 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-006 · Security Note
• https://manageengine.com/products/desktop-central/remote-code-execution.html · Note
• http://osvdb.org/show/osvdb/110643 · Note