Security vulnerabilities in technology software are an ever-present threat to organisations. A prime example of this is the recently discovered vulnerability in the Zoho ManageEngine, a service used by organisations worldwide to manage IT operations. This vulnerability enabled attackers to potentially exploit the Remote Code Execution (RCE) function of the software, which allows execution of malicious code on a system. In this article, we take a look at how this exploit was identified, and how it could be used by malicious hackers.
The discovery of this vulnerability was made by a security researcher known as “Gareth Hay”, who found that a misconfigured version of the product stored a copy of a SQL script which could be accessible to attackers. This script contained the source code for the product which could be reverse-engineered to identify vulnerabilities. Upon reverse engineering the source code, Hay found that the server used for authentication left open an arbitrary file inclusion vulnerability which could be exploited to access the application’s files and execute malicious commands.
Given the simple fact that the malicious code only needed to be uploaded to the vulnerable server, it could be a very quickly deployed attack. Once the attacker had uploaded the malicious code to the server, they would be able to execute commands of their choice, potentially taking control of the system or gathering confidential information stored on it.
Organisations using the Zoho ManageEngine should immediately upgrade to the latest version of the product to minimise the risk of the vulnerability being exploited. Additionally, the system should be regularly monitored for signs of attempted exploitation, such as unusual outbound traffic or changes to the application’s files.
Overall, the Zoho ManageEngine RCE vulnerability is yet another example of how seemingly secure systems can be vulnerable to attack. This highlights the importance of regularly patching systems and staying up-to-date with the latest security developments in order to remain safe from malicious attackers.
This Cyber News was published on securityaffairs.com. Publication date: Mon, 23 Jan 2023 08:46:03 +0000