Threat Signal Report

CVE-2020-10189 Zoho ManageEngine Desktop Central Remote Code Execution Vulnerability

description-logo Description

FortiGuard Labs is aware of a new vulnerability disclosed today on Twitter by security researcher Steven Seeley affecting Zoho ManageEngine Desktop Central. The Zoho ManageEngine Desktop Central is a unified endpoint management solution that helps in managing servers, laptops, desktops, smartphones, and tablets from a central location. Organizational assets connected to the Zoho ManageEngine Desktop Central can be remotely controlled and administered from a central location.


What are the specifics of the vulnerability?

A deserialization vulnerability exists in Zoho ManageEngine that can allow an unauthenticated attacker to execute arbitrary code as ROOT or SYSTEM. This can allow for full control of remote devices being managed by the ManageEngine software. The vulnerability has been assigned CVE-2020-10189.


What versions of software are affected?

All Zoho ManageEngine Desktop Central devices up to build 10.0.474 are affected.


Has the vendor issued a patch?

Yes. Please see the APPENDIX section for a link to the vendor site.


How serious of a vulnerability is this?

HIGH. Besides full unauthenticated root/SYSTEM privileges to the device, an attacker can use a compromised ManageEngine system to fully control machines from afar; as well as installing, removing and altering devices under control of the managed software solution. Hypothetically, this can allow an attacker to install malicious software on all devices administered.


What is that status of AV or IPS coverage?

Update: 4/6

IPS coverage "Zoho.ManageEngine.DC.getChartImage.Remote.Code.Execution" has been released in IPS definitions version 15.811.

IPS coverage is currently being investigated at this time. We will update this Threat Signal with relevant information once feasible.

AV coverage is not feasible for this event.


What mitigation is available if any?

Zoho has released patches for CVE-2020-10189. It is recommended to upgrade to the latest version of Zoho ManageEngine 10.0.479. If patching is not feasible, it is suggested that all public facing machines are placed behind a firewall or a VPN server as soon as time permits and take any other measures to ensure that the machine is not susceptible to external attacks.


MITRE ATT&CK

Exploit Public-Facing Application

ID: T1190

Tactic: Initial Access

Platform: Linux, Windows, macOS, AWS, GCP, Azure

Appendix

Zoho ManageEngine Advisory for CVE-2020-10189

Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.		 Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.		 Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.		 Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.		 Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.