CVE-2021-20108 Denial of service in Manage Engine Asset Explorer Agent
Remote attackers can crash the Manage Engine Asset Explorer Agent by sending repeated commands that trigger memory leaks due to missing certificate validation and improper memory management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20108?
CVE-2021-20108 is a high-severity denial of service vulnerability in Manage Engine Asset Explorer Agent, published on 19 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.
Weakness: CWE-401
Which versions are affected by CVE-2021-20108?
It affects 1 product.
Products include Zohocorp Manageengine Assetexplorer.
How do I fix CVE-2021-20108?
No fix has been published for CVE-2021-20108 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20108 being exploited?
There is no known exploitation of CVE-2021-20108 in the wild and no public exploit code.
Other vulnerabilities in Manage Engine Asset Explorer Agent
Sources
Also known as GHSA-x7m4-fg9v-r3j5.