Command injection in Zoho ManageEngine ServiceDesk Plus MSP

1) Command Injection

EUVDB-ID: #VU69556

Risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-40770

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the system.

The vulnerability exists due to improper input validation within the invokeDataUploadTool() function when handling data passed via the fields required to configure the Analytics Plus integration. A remote privileged user can inject and execute arbitrary commands on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Zoho ManageEngine ServiceDesk Plus MSP: 10500 - 10610

CPE2.3

• cpe:2.3:a:zohocorp:zoho_manageengine_servicedesk_plus_msp:10500:*:*:*:*:*:*:*
• cpe:2.3:a:zohocorp:zoho_manageengine_servicedesk_plus_msp:10501:*:*:*:*:*:*:*
• cpe:2.3:a:zohocorp:zoho_manageengine_servicedesk_plus_msp:10502:*:*:*:*:*:*:*

External links

https://www.manageengine.com/products/service-desk/CVE-2022-40770.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.