CVE-2021-20108
The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 4.50% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-401
- Affected
- zohocorp/manageengine assetexplorer
- Source
- vulnreport@tenable.com
References
- https://www.tenable.com/security/research/tra-2021-29Third Party Advisory
- https://www.tenable.com/security/research/tra-2021-29Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.