PT-2015-3321 · Manageengine · Manageengine Desktop Central

Sinn3R · Published 2015-07-08 · Updated 2020-02-17 · CVE-2015-8249

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 91093

Description The issue is related to the FileUploadServlet class in ManageEngine Desktop Central, which lacks restrictions on file uploads. This can be exploited by a remote, unauthenticated attacker to upload and execute arbitrary files in the context of SYSTEM by injecting a null byte at the end of the ConnectionId parameter value.

Recommendations For ManageEngine Desktop Central versions prior to 9 build 91093, update to build 91093 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileUploadServlet class until a patch is applied. Avoid using the ConnectionId parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-158

CWE-434

Related Identifiers

BDU:2017-02305

CVE-2015-8249

Affected Products

Manageengine Desktop Central

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_connectionid_write.rb · Exploit
• 🔥 https://exploit-db.com/exploits/38982 · Exploit
• 🔥 http://packetstormsecurity.com/files/134806/ManageEngine-Desktop-Central-9-FileUploadServlet-ConnectionId.html · Exploit
• 🔥 https://community.rapid7.com/community/infosec/blog/2015/12/14/r7-2015-22-manageengine-desktop-central-9-fileuploadservlet-connectionid-vulnerability-cve-2015-8249 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8249 · Security Note
• https://bdu.fstec.ru/vul/2017-02305 · Security Note
• http://rapid7.com/db/modules/exploit/windows/http/manageengine_connectionid_write · Note
• https://t.me/securixy_kz/581 · Telegram Post