CVE-2021-44757: ZoHo Patches Authentication Bypass in ManageEngine Desktop Central
ZoHo patches authentication bypass in ManageEngine Desktop Central that could allow attackers to write arbitrary zip files to the server.
Background
On January 17, ZoHo issued an advisory and patches for CVE-2021-44757, a critical authentication bypass in its ManageEngine Desktop Central and ManageEngine Desktop Central MSP products. These are unified endpoint management solutions used to centrally manage a variety of devices including servers, personal computers and mobile devices. In December, ZoHo patched a separate authentication bypass in Desktop Central (CVE-2021-44515) that was actively exploited in the wild as a zero-day. At this time, there is no information stating that CVE-2021-44757 has been exploited in the wild.
Analysis
CVE-2021-44757 is a critical authentication bypass vulnerability that could allow a remote attacker to access sensitive data and write arbitrary zip files to a vulnerable server. At the time of publication, there is no CVSS score available for this vulnerability. Osword from SGLAB of Legendsec at Qi'anxin Group were credited with disclosing this vulnerability.
Given the history of exploitation against ZoHo ManageEngine Desktop Central, attackers are likely to adopt this vulnerability. Shortly after CVE-2021-44515 was publicly disclosed, the Cybersecurity and Infrastructure Security Agency added the CVE to its Catalog of Known Exploited Vulnerabilities, mandating that federal agencies find and fix vulnerable servers by December 24, 2021. On December 17, the Federal Bureau of Investigation issued an advisory about advanced persistent threat activity targeting ZoHo ManageEngine Desktop Central servers with CVE-2021-44515 beginning in October 2021.
Proof of concept
At the time of publication, there is no proof-of-concept available.
Solution
ZoHo released Desktop Central and Desktop Central MSP version 10.1.2137.9 to address this vulnerability. The advisory also includes guidance on hardening these solutions.
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Get more information
- CVE-2021-44515: ZoHo Patches ManageEngine Zero-Day Exploited in the Wild
- CVE-2021-44757 Security Advisory
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
Cybersecurity Snapshot: Russia-backed Hackers Aim at Critical Infrastructure Orgs, as Crypto Fraud Balloons
September 13, 2024Critical infrastructure operators must beware of Russian military hacking groups. Plus, cyber scammers are having a field day with crypto fraud. Meanwhile, AI and cloud vendors face stricter reporting regulations in the U.S. And get the latest on AI-model risk management and on cybersecurity understaffing!
Cybersecurity Snapshot: RansomHub Group Triggers CISA Warning, While FBI Says North Korean Hackers Are Targeting Crypto Orgs
September 6, 2024Cybersecurity teams must beware of RansomHub, a surging RaaS gang. Plus, North Korea has unleashed sophisticated social-engineering schemes against crypto employees. Meanwhile, a new SANS report stresses the importance of protecting ICS and OT systems. And a Tenable poll sheds light on cloud-native VM. And much more!
Cybersecurity Snapshot: Schools Suffer Heavy Downtime Losses Due To Ransomware, as Banks Grapple with AI Challenges
August 30, 2024The cost of ransomware downtime in schools gets pegged at $500K-plus per day. Meanwhile, check out the AI-usage risks threatening banks’ cyber resilience. Plus, Uncle Sam is warning about a dangerous Iran-backed hacking group. And get the latest on AI-system inventories, the APT29 nation-state attacker and digital identity security!
Mastering Containerization: Key Strategies and Best Practices
September 17, 2024As organizations modernize their infrastructure, containers offer unparalleled flexibility and scalability but they also introduce unique security challenges. In this blog we explain container security challenges, identify top threats and share how the newly released Tenable Enclave Security can keep your containers secure.
CloudImposer: Executing Code on Millions of Google Servers with a Single Malicious Package
September 16, 2024Tenable Research discovered a remote code execution (RCE) vulnerability in Google Cloud Platform (GCP) that is now fixed and that we dubbed CloudImposer. The vulnerability could have allowed an attacker to hijack an internal software dependency that Google pre-installs on each Google Cloud Composer pipeline-orchestration tool. Tenable Research also found risky guidance in GCP documentation that customers should be aware of.
Cybersecurity Snapshot: Russia-backed Hackers Aim at Critical Infrastructure Orgs, as Crypto Fraud Balloons
September 13, 2024Critical infrastructure operators must beware of Russian military hacking groups. Plus, cyber scammers are having a field day with crypto fraud. Meanwhile, AI and cloud vendors face stricter reporting regulations in the U.S. And get the latest on AI-model risk management and on cybersecurity understaffing!
- Risk-based Vulnerability Management
- Vulnerability Management