PT-2018-18308 · Zoho · Zoho Manageengine Applications Manager

Mehmet Ince · Published 2018-03-08 · Updated 2019-10-03 · CVE-2018-7890

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Applications Manager versions prior to 13.6 (build 13640)

Description: A remote code execution issue was discovered. The publicly accessible "testCredential.do" endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes, and then executes a PowerShell script. If the specified system is OfficeSharePointServer, then the username and password parameters to this script are not validated, leading to Command Injection.

Recommendations: For versions prior to 13.6 (build 13640), update to version 13.6 (build 13640) or later to resolve the issue. As a temporary workaround, consider restricting access to the "testCredential.do" endpoint until a patch is available. Avoid using the username and password parameters in the affected endpoint when the specified system is OfficeSharePointServer until the issue is resolved.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-7890

Affected Products

Zoho Manageengine Applications Manager

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/pull/9684 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_appmanager_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44274 · Exploit
• 🔥 https://pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7890 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7890 · Vendor Advisory
• https://pitstop.manageengine.com/portal/community/topic/security-vulnerability-issues-fixed-upgrade-to-the-latest-version-of-applications-manager · Note
• http://securityfocus.com/bid/103358 · Note
• https://manageengine.com/products/applications_manager/security-updates/security-updates-cve-2018-7890.html · Note