Synopsis
ManageEngine OpManager Remote Directory Deletion (CVE-2021-20078)
This is an unauthenticated path traversal remote directory deletion vulnerability in ManageEngine OpManager build 125346. The flaw exists in the Spark Gateway component in ManageEngine OpManager due to improper validation of user-supplied data prior to a directory deletion operation:
The vulnerability can be exploited with the following CURL command where the recordingFile is controlled via the 'server' URL parameter:
curl -i -H 'Sec-WebSocket-Key: dZ5/5knh6Tky32w9JDXbDQ==' -H 'Sec-WebSocket-Version: 13' -H 'Upgrade: websocket' 'http://<opmanager-host>:7275/RDP?server=../../../../../../../../<folder_to_be_deleted>/AAA&width=1440&height=788'
The recordingFile and the containing directory don't get deleted because the recordingFile is in use at the time of deletion. However, other files and sub-directories under the recordingFile's containing directory can be deleted. For example, if server=../../../../../../../../AAA is used, a file named C:\AAA.rdpv will be created on a Windows-based OpManager host and the OpManager (which runs as SYSTEM) will attempt to delete the entire C drive recursively. Although C:\AAA.rdpv will not be deleted, other files and sub-directories under C:\ can be deleted. This will not only delete some (deletable) OpManager files (i.e., DoS) but also cause the entire host in an unstable/unusable state.
Solution
Update ManageEngine OpManager to build version 125362.Proof of Concept
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team