Zoho ManageEngine OpManager < 12.5.329 - Remote Code Execution

criticalseverity

9.8CVSS score

51.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Zoho ManageEngine OpManager before 12.5.329 contains a remote code execution caused by a general bypass in the deserialization class, letting unauthenticated attackers execute arbitrary code, exploit requires no authentication

Impact

Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.

Fix

Update to version 12.5.329 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: status_code == 200 and compare_versions(version, '< 125329', '>= 125000') and contains(body, 'ManageEngine')

Run it with nuclei: nuclei -id CVE-2021-3287 -u <target>

The full check

id: CVE-2021-3287

info:
  name: Zoho ManageEngine OpManager < 12.5.329 - Remote Code Execution
  author: theamanrawat
  severity: critical
  description: |
    Zoho ManageEngine OpManager before 12.5.329 contains a remote code execution caused by a general bypass in the deserialization class, letting unauthenticated attackers execute arbitrary code, exploit requires no authentication
  impact: |
    Unauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.
  remediation: |
    Update to version 12.5.329 or later.
  reference:
    - http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3287
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-3287
    epss-score: 0.51332
    epss-percentile: 0.98949
    cwe-id: CWE-502
    cpe: cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: zohocorp
    product: manageengine_opmanager
    shodan-query:
      - http.title:"opmanager plus"
      - http.title:"opmanager"
    fofa-query:
      - title="opmanager plus"
      - title="opmanager"
    google-query:
      - intitle:"opmanager plus"
      - intitle:"opmanager"
  tags: cve,cve2021,deserialization,rce,opmanager,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 3

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "compare_versions(version, '< 125329', '>= 125000')"
          - "contains(body, 'ManageEngine')"
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'cachestart\/([0-9.]+)\/cacheend'

References

Use this check only on systems you are authorised to test. Where the data comes from