Rapid7 Vulnerability & Exploit Database

ManageEngine Multiple Products Authenticated File Upload

Back to Search

ManageEngine Multiple Products Authenticated File Upload

Disclosed
12/15/2014
Created
05/30/2018

Description

This module exploits a directory traversal vulnerability in ManageEngine ServiceDesk, AssetExplorer, SupportCenter and IT360 when uploading attachment files. The JSP that accepts the upload does not handle correctly '../' sequences, which can be abused to write to the file system. Authentication is needed to exploit this vulnerability, but this module will attempt to login using the default credentials for the administrator and guest accounts. Alternatively, you can provide a pre-authenticated cookie or a username / password. For IT360 targets, enter the RPORT of the ServiceDesk instance (usually 8400). All versions of ServiceDesk prior v9 build 9031 (including MSP but excluding v4), AssetExplorer, SupportCenter and IT360 (including MSP) are vulnerable. At the time of release of this module, only ServiceDesk v9 has been fixed in build 9031 and above. This module has been tested successfully in Windows and Linux on several versions.

Author(s)

  • Pedro Ribeiro <pedrib@gmail.com>

Platform

Java

Architectures

java

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/manageengine_auth_upload
msf exploit(manageengine_auth_upload) > show targets
    ...targets...
msf exploit(manageengine_auth_upload) > set TARGET < target-id >
msf exploit(manageengine_auth_upload) > show options
    ...show and set options...
msf exploit(manageengine_auth_upload) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;