Zoho ManageEngine - Internal Hostname Disclosure

mediumseverity

5.3CVSS score

13.2%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.

Impact

An attacker could use the disclosed internal hostnames to plan targeted attacks, gain unauthorized access, or perform reconnaissance on the internal network.

Fix

Apply the latest security patch or update provided by Zoho ManageEngine to fix the internal hostname disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/themes
Positive when: contains in header "/themes/" and "text/html" AND not contains in location "{{Host}}" AND contains "<center><h1>301 Moved Permanently</h1></center>" AND matches in location /https?:\/\/(.*):/ AND status 301

Run it with nuclei: nuclei -id CVE-2022-23779 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-23779

info:
  name: Zoho ManageEngine - Internal Hostname Disclosure
  author: cckuailong
  severity: medium
  description: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.
  impact: |
    An attacker could use the disclosed internal hostnames to plan targeted attacks, gain unauthorized access, or perform reconnaissance on the internal network.
  remediation: |
    Apply the latest security patch or update provided by Zoho ManageEngine to fix the internal hostname disclosure vulnerability.
  reference:
    - https://www.manageengine.com/products/desktop-central/cve-2022-23779.html
    - https://github.com/fbusr/CVE-2022-23779
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23779
    - https://github.com/soosmile/POC
    - https://github.com/zecool/cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-23779
    cwe-id: CWE-200
    epss-score: 0.13229
    epss-percentile: 0.9641
    cpe: cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zohocorp
    product: manageengine_desktop_central
    shodan-query: http.title:"manageengine desktop central 10"
    fofa-query:
      - app="ZOHO-ManageEngine-Desktop"
      - title="manageengine desktop central 10"
      - app="zoho-manageengine-desktop"
    google-query: intitle:"manageengine desktop central 10"
  tags: cve,cve2022,zoho,exposure,zohocorp,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/themes"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - '/themes/'
          - 'text/html'
        condition: and

      - type: word
        part: location
        negative: true
        words:
          - '{{Host}}'

      - type: word
        words:
          - '<center><h1>301 Moved Permanently</h1></center>'

      - type: regex
        part: location
        regex:
          - 'https?:\/\/(.*):'

      - type: status
        status:
          - 301

    extractors:
      - type: regex
        group: 1
        regex:
          - 'https?:\/\/(.*):'
        part: location

References

Use this check only on systems you are authorised to test. Where the data comes from