Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
{"zdi": [{"lastseen": "2022-11-28T22:04:54", "description": "This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ServiceDesk Plus. Authentication is required to exploit this vulnerability. The specific flaw exists within the invokeDataUploadTool function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.", "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-11-21T00:00:00", "type": "zdi", "title": "ManageEngine ServiceDesk Plus invokeDataUploadTool Command Injection Remote Code Execution Vulnerability", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2022-40770"], "modified": "2022-11-21T00:00:00", "id": "ZDI-22-1611", "href": "https://www.zerodayinitiative.com/advisories/ZDI-22-1611/", "cvss": {"score": 0.0, "vector": "NONE"}}], "nessus": [{"lastseen": "2023-01-14T20:37:42", "description": "A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus prior to 13.0 Build 13011 due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. \n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-12-02T00:00:00", "type": "nessus", "title": "ManageEngine ServiceDesk Plus < 13.0 Build 13011 RCE", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2022-40770"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/a:zohocorp:manageengine_servicedesk_plus"], "id": "MANAGEENGINE_SERVICEDESK_13011.NASL", "href": "https://www.tenable.com/plugins/nessus/168359", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(168359);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\"CVE-2022-40770\");\n script_xref(name:\"IAVA\", value:\"2022-A-0497\");\n\n script_name(english:\"ManageEngine ServiceDesk Plus < 13.0 Build 13011 RCE\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server hosts an application that is affected by a remote code execution vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus prior to 13.0 Build 13011 \ndue to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an \nadministrator role access. \n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version \nnumber.\");\n # https://www.manageengine.com/products/service-desk/CVE-2022-40770.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?888eb2db\");\n # https://www.manageengine.com/products/service-desk/on-premises/readme.html#readme130\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?40ba6aa6\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to ManageEngine ServiceDesk Plus version 13.0 Build 13011, or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-40770\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/11/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/09/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/12/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:zohocorp:manageengine_servicedesk_plus\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"manageengine_servicedesk_detect.nasl\");\n script_require_keys(\"installed_sw/manageengine_servicedesk\");\n script_require_ports(\"Services/www\", 8080);\n\n exit(0);\n}\n\ninclude('vcf_extras_zoho.inc');\ninclude('http.inc');\n\nvar appname = 'ManageEngine ServiceDesk Plus';\n\nvar port = get_http_port(default:8080);\nvar app_info = vcf::zoho::servicedesk::get_app_info(app:appname, port:port);\n\nvar constraints = [\n {'fixed_version': '13.0.13011', 'fixed_display': '13.0 Build 13011'} \n];\n\nvcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-01-14T08:43:00", "description": "A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 Build 13000 due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. The option to integrate Zoho Analytics will no longer be available on ServiceDesk Plus MSP UI in build 13000. \n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-12-02T00:00:00", "type": "nessus", "title": "ManageEngine ServiceDesk Plus MSP < 13.0 Build 13000 RCE", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2022-40770"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/a:zohocorp:manageengine_servicedesk_plus_msp"], "id": "MANAGEENGINE_SERVICEDESK_MSP_13000.NASL", "href": "https://www.tenable.com/plugins/nessus/168355", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(168355);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\"CVE-2022-40770\");\n script_xref(name:\"IAVA\", value:\"2022-A-0497\");\n\n script_name(english:\"ManageEngine ServiceDesk Plus MSP < 13.0 Build 13000 RCE\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server hosts an application that is affected by a remote code execution vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"A remote code execution vulnerability exists in ManageEngine ServiceDesk Plus MSP prior to 13.0 \nBuild 13000 due to a flaw in the Analytics Plus integration input field validation. Vulnerability \nrequires an administrator role access. The option to integrate Zoho Analytics will no longer be \navailable on ServiceDesk Plus MSP UI in build 13000. \n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version \nnumber.\");\n # https://www.manageengine.com/products/service-desk/CVE-2022-40770.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?888eb2db\");\n # https://www.manageengine.com/products/service-desk-msp/readme.html#13000\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?68c25399\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to ManageEngine ServiceDesk Plus MSP version 13.0 Build 13000, or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-40770\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/11/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/10/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/12/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:zohocorp:manageengine_servicedesk_plus_msp\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"manageengine_servicedesk_detect.nasl\");\n script_require_keys(\"installed_sw/manageengine_servicedesk\");\n script_require_ports(\"Services/www\", 8080);\n\n exit(0);\n}\n\ninclude('vcf_extras_zoho.inc');\ninclude('http.inc');\n\nvar appname = 'ManageEngine ServiceDesk Plus MSP';\n\nvar port = get_http_port(default:8080);\nvar app_info = vcf::zoho::servicedesk::get_app_info(app:appname, port:port);\n\nvar constraints = [\n {'fixed_version': '13.0.13000', 'fixed_display': '13.0 Build 13000'} \n];\n\nvcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-01-15T03:11:54", "description": "The version of ManageEngine SupportCenter Plus prior to 11.0 Build 11026 is running on the remote web server. It is, therefore, affected by multiple vulnerabilities, including the following:\n\n - A remote code execution vulnerability due to a flaw in the Analytics Plus integration input field validation. Vulnerability requires an administrator role access. (CVE-2022-40770)\n\n - An XML external entity (XXE) vulnerability due to a flaw in the Analytics Plus integration.\n Threat actors with admin role access can retrieve local files from the server. (CVE-2022-40771)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2022-12-02T00:00:00", "type": "nessus", "title": "ManageEngine SupportCenter Plus < 11.0 Build 11026 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2022-40770", "CVE-2022-40771"], "modified": "2022-12-05T00:00:00", "cpe": ["cpe:/a:manageengine:supportcenter_plus"], "id": "MANAGEENGINE_SUPPORTCENTER_11026.NASL", "href": "https://www.tenable.com/plugins/nessus/168358", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(168358);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/12/05\");\n\n script_cve_id(\"CVE-2022-40770\", \"CVE-2022-40771\");\n script_xref(name:\"IAVA\", value:\"2022-A-0497\");\n\n script_name(english:\"ManageEngine SupportCenter Plus < 11.0 Build 11026 Multiple Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server hosts an application that is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of ManageEngine SupportCenter Plus prior to 11.0 Build 11026 is running on the remote \nweb server. It is, therefore, affected by multiple vulnerabilities, including the following:\n\n - A remote code execution vulnerability due to a flaw in the Analytics Plus integration input \n field validation. Vulnerability requires an administrator role access. (CVE-2022-40770)\n\n - An XML external entity (XXE) vulnerability due to a flaw in the Analytics Plus integration.\n Threat actors with admin role access can retrieve local files from the server. (CVE-2022-40771)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's\nself-reported version number.\");\n # https://www.manageengine.com/products/service-desk/CVE-2022-40770.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?888eb2db\");\n # https://www.manageengine.com/products/service-desk/CVE-2022-40771.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ad23e3c8\");\n # https://www.manageengine.com/products/support-center/readme.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?e2a6242a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to ManageEngine SupportCenter Plus version 11.0 Build 11026, or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2022-40770\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2022/11/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/10/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/12/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:manageengine:supportcenter_plus\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 Tenable, Inc.\");\n\n script_dependencies(\"manageengine_supportcenter_detect.nasl\");\n script_require_keys(\"installed_sw/ManageEngine SupportCenter\");\n\n exit(0);\n}\n\ninclude('vcf.inc');\ninclude('vcf_extras_zoho.inc');\ninclude('http.inc');\n\nvar port = get_http_port(default:8080);\nvar appname = 'ManageEngine SupportCenter';\n\nvar app_info = vcf::zoho::fix_parse::get_app_info(app:appname, port:port);\n\nvar constraints = [\n {'fixed_version': '11026', 'fixed_display' : '11.0 Build 11026'}\n];\n\nvcf::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_HOLE\n);\n\n", "cvss": {"score": 0.0, "vector": "NONE"}}]}
CVE-2022-40770
