ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload RCE (intrusive check)

critical Nessus Plugin ID 71217

Language:

Synopsis

The remote web server contains a Java-based web application that is affected by a remote code execution vulnerability.

Description

The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the AgentLogUploadServlet script to properly sanitize user-supplied input to the 'fileName' parameter. A remote, unauthenticated attacker can exploit this to upload to the remote host files containing arbitrary code and then execute them with NT-AUTHORITY\SYSTEM privileges.

Note that this plugin tries to upload a JSP file to <DocumentRoot> (i.e., C:\ManageEngine\DesktopCentral_Server\webapps\DesktopCentral\) and then fetch it, thus executing the Java code in the JSP file. The plugin attempts to delete the JSP file after a successful upload and fetch. The user is advised to delete the JSP file if Nessus fails to delete it.

Solution

Upgrade to ManageEngine Desktop Central 8 build 80293 or later.

Plugin Details

Severity: Critical

ID: 71217

File Name: manageengine_desktop_central_agentloguploadservlet_file_upload.nasl

Version: 1.13

Type: remote

Family: CGI abuses

Published: 12/4/2013

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:zohocorp:manageengine_desktop_central

Required KB Items: installed_sw/ManageEngine Desktop Central

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 10/30/2013

Vulnerability Publication Date: 11/9/2013

Exploitable With

Metasploit (ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload)

Reference Information

CVE: CVE-2013-7390

BID: 63784

Detections

Analytics