← Advisories

ManageEngine OpManager Privilege Escalation

Medium
Advisory ID
ZSL-2019-5504
Release Date
18 January 2019
Vendor
Zoho Corporation Pvt. Ltd. - https://www.manageengine.com
Affected Version
12.3
CVE
N/A
Tested On
Microsoft Windows 7 x64
Summary

OpManager offers comprehensive network monitoring capabilities that help you monitor network performance, detect network faults in real time, troubleshoot errors, and prevent downtime. Being a powerful network monitor, it supports multi-vendor IT environments and can scale to fit your network, regardless of its size. Monitor your devices and network to gain complete visibility and control over your entire network infrastructure. It allows you to monitor critical performance metrics like availability, CPU, disk space, and memory utilization across physical and virtual servers.

Description

The OpManager Monitoring service suffers from a weak permissions issue in which an attacker can replace the service binary with a binary of her choice. This service runs as Localsystem thus allowing for a privilege escalation vector.

Proof of Concept
Disclosure Timeline
14.01.2019Vulnerability discovered. [15.01.2019[ Vendor contacted.
17.01.2019No response from the vendor.
18.01.2019Public security advisory released.
Credits
Vulnerability discovered by Humberto Cabrera
References
Changelog
18.01.2019Initial release
27.01.2019Added reference [1] and [2]