🔙 목록으로 돌아가기

CVE-2021-3287: Zoho ManageEngine OpManager < 12.5.329 - Remote Code Execution

TitleZoho ManageEngine OpManager < 12.5.329 - Remote Code Execution
Authortheamanrawat
SeverityCritical
ImpactUnauthenticated attackers can execute arbitrary code remotely, leading to full system compromise.
RemediationUpdate to version 12.5.329 or later.
CVSS Score9.8
EPSS Score0.8849
CVE IDCVE-2021-3287
CWE IDCWE-502
Shodan Queryhttp.title:"opmanager plus"http.title:"opmanager"
Fofa Querytitle="opmanager plus"title="opmanager"
Tags cve cve2021 deserialization rce opmanager passive vkev

🔍 Vulnerability Description

Zoho ManageEngine OpManager before 12.5.329 contains a remote code execution caused by a general bypass in the deserialization class, letting unauthenticated attackers execute arbitrary code, exploit requires no authentication

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3287.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-3287.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A