logo
DATABASE RESOURCES PRICING ABOUT US

Several Zoho ManageEngine products have been exploited

Description

#### THREAT LEVEL: Red. For a detailed advisory, [download the pdf file here.](<https://www.hivepro.com/wp-content/uploads/2021/11/Several-Zoho-ManageEngine-products-have-been-exploited_TA202154.pdf>)[![](chrome-extension://gmpljdlgcdkljlppaekciacdmdlhfeon/images/beside-link-icon.svg)](<https://docs.google.com/viewer?url=https%3A%2F%2Fwww.hivepro.com%2Fwp-content%2Fuploads%2F2021%2F11%2FSeveral-Zoho-ManageEngine-products-have-been-exploited_TA202154.pdf&embedded=true&chrome=false&dov=1> "View this pdf file" ) Multiple vulnerabilities have been discovered in Zoho ManageEngine products. The affected products include Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine SupportCenter Plus, Zoho ManageEngine Desktop Central, Zoho ManageEngine AssetExplorer. CVE 2021 44077 is a vulnerability that could allow an attacker to run arbitrary code. It was discovered on November 20, 2021. This vulnerability, however, may be easily fixed by updating to Zoho version 11306, which was released in September. Attackers are focusing on the healthcare, financial services, electronics, and IT consulting businesses by exploiting this vulnerability. CVE 2021 44515 & CVE 2021 44526 are authentication bypass vulnerabilities. CVE 2021 44515 only affects Zoho ManageEngine ServiceDesk and Zoho ManageEngine AssetExplorer who uses Desktop Central Agent for asset discovery and CVE 2021 44526 affects all vulnerable versions of Zoho ManageEngine ServiceDesk and Zoho ManageEngine AssetExplorer. Two of these vulnerabilities (CVE 2021 44077 and CVE 2021 44515) have been exploited in the wild so organizations should upgrade their Zoho ManageEngine products to their latest versions to eliminate these vulnerabilities. The Techniques used by an unknown actor to exploit CVE 2021 44077 includes: T1190 - Exploit Public Facing Application T1505.003 - Server Software Component: Web Shell T1027 - Obfuscated Files or Information T1140 - Deobfuscate/Decode Files or Information T1003 - OS Credential Dumping T1218 - Signed Binary Proxy Execution T1136 - Create Account T1003.003 - OS Credential Dumping: NTDS T1047 - Windows Management Instrumentation T1070.004 - Indicator Removal on Host: File Deletion T1087.002 - Account Discovery: Domain Account T1560.001 - Archive Collected Data: Archive via Utility T1573.001 - Encrypted Channel: Symmetric Cryptography[](<https://docs.google.com/viewer?url=https%3A%2F%2Fwww.hivepro.com%2Fwp-content%2Fuploads%2F2021%2F12%2FMicrosoft-could-not-patch-this-vulnerability-yet-again_TA202153.pdf&embedded=true&chrome=false&dov=1> "View this pdf file" ) #### Vulnerability Details ![](https://www.hivepro.com/wp-content/uploads/2021/12/VD-TA202154-1024x424.png) #### Indicators of Compromise(IoCs) * ![](https://www.hivepro.com/wp-content/uploads/2021/12/IOC--1024x807.png) #### Patch Link <https://www.manageengine.com/desktop-management-msp/cve-2021-44515-security-advisory.html> <https://www.manageengine.com/products/service-desk/security-response-plan.html> <https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44526-and-cve-2021-44515-authentication-bypass-vulnerabilities-in-servicedesk-plus-and-desktop-central> <https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44526-and-cve-2021-44515-authentication-bypass-vulnerabilities-in-assetexplorer-and-desktop-central> #### References <https://us-cert.cisa.gov/ncas/alerts/aa21-336a> <https://www.bleepingcomputer.com/news/security/zoho-patch-new-manageengine-bug-exploited-in-attacks-asap/> <https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/> * Indicates parameters that apply to CVE-2021-44077


Related