CVE-2020-10189 Zoho ManageEngine Desktop Central Remote Code Execution Vulnerability

Description

FortiGuard Labs is aware of a new vulnerability disclosed today on Twitter by security researcher Steven Seeley affecting Zoho ManageEngine Desktop Central. The Zoho ManageEngine Desktop Central is a unified endpoint management solution that helps in managing servers, laptops, desktops, smartphones, and tablets from a central location. Organizational assets connected to the Zoho ManageEngine Desktop Central can be remotely controlled and administered from a central location.

What are the specifics of the vulnerability?

A deserialization vulnerability exists in Zoho ManageEngine that can allow an unauthenticated attacker to execute arbitrary code as ROOT or SYSTEM. This can allow for full control of remote devices being managed by the ManageEngine software. The vulnerability has been assigned CVE-2020-10189.

What versions of software are affected?

All Zoho ManageEngine Desktop Central devices up to build 10.0.474 are affected.

Has the vendor issued a patch?

Yes. Please see the APPENDIX section for a link to the vendor site.

How serious of a vulnerability is this?

HIGH. Besides full unauthenticated root/SYSTEM privileges to the device, an attacker can use a compromised ManageEngine system to fully control machines from afar; as well as installing, removing and altering devices under control of the managed software solution. Hypothetically, this can allow an attacker to install malicious software on all devices administered.

What is that status of AV or IPS coverage?

Update: 4/6

IPS coverage "Zoho.ManageEngine.DC.getChartImage.Remote.Code.Execution" has been released in IPS definitions version 15.811.

IPS coverage is currently being investigated at this time. We will update this Threat Signal with relevant information once feasible.

AV coverage is not feasible for this event.

What mitigation is available if any?

Zoho has released patches for CVE-2020-10189. It is recommended to upgrade to the latest version of Zoho ManageEngine 10.0.479. If patching is not feasible, it is suggested that all public facing machines are placed behind a firewall or a VPN server as soon as time permits and take any other measures to ensure that the machine is not susceptible to external attacks.

MITRE ATT&CK

Exploit Public-Facing Application

ID: T1190

Tactic: Initial Access

Platform: Linux, Windows, macOS, AWS, GCP, Azure

Appendix