CVE-2021-44077 Zoho ManageEngine ServiceDesk Plus Remote Code Execution
Unauthenticated attackers can execute arbitrary code via vulnerable RestAPI endpoints in ManageEngine ServiceDesk Plus and SupportCenter Plus.
- Exploited in the wild
- Since 1 Dec 2021
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-44077?
CVE-2021-44077 is a critical missing authorization vulnerability in Zohocorp Manageengine Servicedesk Plus, published on 29 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
Weakness: CWE-306
Which versions are affected by CVE-2021-44077?
It affects 3 products.
Products include Zohocorp Manageengine Servicedesk Plus, Zohocorp Manageengine Servicedesk Plus Msp, Zohocorp Manageengine Supportcenter Plus.
How do I fix CVE-2021-44077?
No fix has been published for CVE-2021-44077 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Dec 2021.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-44077 being exploited?
Yes. Attackers have exploited CVE-2021-44077 in the wild since at least 1 Dec 2021.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Zohocorp Manageengine Servicedesk Plus
Sources
Also known as GHSA-xm89-vxjx-jvcg.