{
  "Name": "Zoho ManageEngine ServiceDesk Plus RCE (CVE-2021-44077)",
  "Description": "<p>ZOHO ManageEngine ServiceDesk Plus (SDP) is a set of IT service management software based on ITIL architecture from ZOHO. The software integrates functional modules such as incident management, problem management, asset management IT project management, procurement and contract management.</p><p>ZOHO ManageEngine ServiceDesk Plus has any file upload vulnerability. An unauthorized attacker can upload an exe file and execute the exe file through /RestAPI/s247action, resulting in taking over the server permissions.</p>",
  "Product": "Zoho ManageEngine ServiceDesk Plus",
  "Homepage": "https://pitstop.manageengine.com",
  "DisclosureDate": "2021-12-08",
  "Author": "1291904552@qq.com",
  "FofaQuery": "body=\"ManageEngine ServiceDesk Plus\"",
  "GobyQuery": "body=\"ManageEngine ServiceDesk Plus\"",
  "Level": "2",
  "Impact": "<p>ZOHO ManageEngine ServiceDesk Plus has any file upload vulnerability. An unauthorized attacker can upload an exe file and execute the exe file through /RestAPI/s247action, resulting in taking over the server permissions.</p>",
  "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021\">https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2.If not necessary, prohibit public network access to the system.</p>",
  "Translation": {
    "CN": {
      "Name": "Zoho ManageEngine ServiceDesk Plus RCE (CVE-2021-44077)",
      "VulType": ["代码执行"],
	  "Tags": ["代码执行"],
      "Description": "<p>ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。</p><p>ZOHO ManageEngine ServiceDesk Plus 存在任意文件上传漏洞，未经身份验证的攻击者可以上传exe文件，并通过/RestAPI/s247action执行exe文件，造成接管服务器权限。</p>",
      "Impact": "<p>ZOHO ManageEngine ServiceDesk Plus 存在任意文件上传漏洞，未经身份验证的攻击者可以上传exe文件，并通过/RestAPI/s247action执行exe文件，造成接管服务器权限。</p>",
      "Product": "Zoho ManageEngine ServiceDesk Plus",
      "Recommendation": "<p>⼚商已发布了漏洞修复程序，请及时关注更新：<a href=\"https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021\">https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021</a></p><p>1、通过防⽕墙等安全设备设置访问策略，设置⽩名单访问。</p><p>2、如⾮必要，禁⽌公⽹访问该系统。</p>"
    },
    "EN": {
      "Name": "Zoho ManageEngine ServiceDesk Plus RCE (CVE-2021-44077)",
      "VulType": ["rce"],
	  "Tags": ["rce"],
      "Description": "<p>ZOHO ManageEngine ServiceDesk Plus (SDP) is a set of IT service management software based on ITIL architecture from ZOHO. The software integrates functional modules such as incident management, problem management, asset management IT project management, procurement and contract management.</p><p>ZOHO ManageEngine ServiceDesk Plus has any file upload vulnerability. An unauthorized attacker can upload an exe file and execute the exe file through /RestAPI/s247action, resulting in taking over the server permissions.</p>",
      "Impact": "<p>ZOHO ManageEngine ServiceDesk Plus has any file upload vulnerability. An unauthorized attacker can upload an exe file and execute the exe file through /RestAPI/s247action, resulting in taking over the server permissions.</p>",
      "Product": "Zoho ManageEngine ServiceDesk Plus",
      "Recommendation": "<p>The vendor has released a bug fix, please pay attention to the update in time: <a href=\"https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021\">https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021</a></p><p>1. Set access policies and whitelist access through security devices such as firewalls.</p><p>2.If not necessary, prohibit public network access to the system.</p>"
    }
  },
  "References": [
    "https://xz.aliyun.com/t/10631"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "name": "AttackType",
      "type": "select",
      "value": "goby_shell_linux"
    }
  ],
  "ExpTips": null,
  "ScanSteps": null,
  "Tags": [
    "rce"
  ],
  "VulType": [
    "rce"
  ],
  "CVEIDs": [
    "CVE-2021-44077"
  ],
  "CVSSScore": "9.0",
  "AttackSurfaces": {
    "Application": ["Zoho ManageEngine ServiceDesk Plus"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "CNNVD": [
    "CNNVD-202111-2144"
  ],
  "CNVD": [
    ""
  ]
}