ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)

high Nessus Plugin ID 82078

Language:

Synopsis

The remote web server contains a Java-based web application that is affected by a remote code execution vulnerability.

Description

The version of ManageEngine Desktop Central running on the remote host is affected by a remote code execution vulnerability due to a failure by the statusUpdate script to properly sanitize user-supplied input to the 'fileName' parameter when performing an 'LFU' action to statusUpdate. A remote, unauthenticated attacker can exploit this, via a crafted 'dot dot' request, to upload to the remote host files containing arbitrary code and then execute them with NT-AUTHORITY\SYSTEM privileges.

Note that ManageEngine Desktop Central is reportedly affected by other vulnerabilities as well, although Nessus has not tested for these.

Also note this plugin tries to upload a JSP file to <DocumentRoot> (i.e., C:\ManageEngine\DesktopCentral_Server\webapps\DesktopCentral\) and then fetch it, thus executing the Java code in the JSP file. The plugin attempts to delete the JSP file after a successful upload and fetch. The user is advised to delete the JSP file if Nessus fails to delete it.

Solution

Upgrade to ManageEngine Desktop Central 9 build 90055 or later.

Plugin Details

Severity: High

ID: 82078

File Name: manageengine_desktop_central_90055_rce.nasl

Version: 1.12

Type: remote

Family: CGI abuses

Published: 3/25/2015

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2014-5005

Vulnerability Information

CPE: cpe:/a:zohocorp:manageengine_desktop_central

Required KB Items: installed_sw/ManageEngine Desktop Central

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 8/7/2014

Vulnerability Publication Date: 8/31/2014

Exploitable With

Metasploit (ManageEngine Desktop Central StatusUpdate Arbitrary File Upload)

Elliot (ManageEngine Desktop Central 9.0.0 File Upload)

Reference Information

CVE: CVE-2014-5005

BID: 69494

Detections

Analytics