« Volver al listado

CVE-2021-20110

Estado: ModificadaCrítica (9.8)—

Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In httphandler.cpp, the agent reaching out over HTTP is vulnerable to an Integer Overflow, which can be turned into a Heap Overflow allowing for remote code execution as NT AUTHORITY/SYSTEM on the agent machine.

Leer descripción completaMostrar menos

The Integer Overflow occurs when receiving POST response from the Manage Engine server, and the agent calling "HttpQueryInfoW" in order to get the "Content-Length" size from the incoming POST request. This size is taken, but multiplied to a larger amount. If an attacker specifies a Content-Length size of 1073741823 or larger, this integer arithmetic will wrap the value back around to smaller integer, then calls "calloc" with this size to allocate memory. The following API "InternetReadFile" will copy the POST data into this buffer, which will be too small for the contents, and cause heap overflow.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zohocorp — Manageengine Assetexplorer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-20110",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vulnreport@tenable.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Manage Engine Asset Explorer Agent",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.34"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-19T15:15:07.703",
  "references": [
    {
      "url": "https://www.tenable.com/security/research/tra-2021-31",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vulnreport@tenable.com"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2021-31",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In httphandler.cpp, the agent reaching out over HTTP is vulnerable to an Integer Overflow, which can be turned into a Heap Overflow allowing for remote code execution as NT AUTHORITY/SYSTEM on the agent machine. The Integer Overflow occurs when receiving POST response from the Manage Engine server, and the agent calling \"HttpQueryInfoW\" in order to get the \"Content-Length\" size from the incoming POST request. This size is taken, but multiplied to a larger amount. If an attacker specifies a Content-Length size of 1073741823 or larger, this integer arithmetic will wrap the value back around to smaller integer, then calls \"calloc\" with this size to allocate memory. The following API \"InternetReadFile\" will copy the POST data into this buffer, which will be too small for the contents, and cause heap overflow."
    },
    {
      "lang": "es",
      "value": "Debido a que Manage Engine Asset Explorer Agent versión 1.0.34,  no comprueba los certificados HTTPS, un atacante en la red puede configurar estáticamente su dirección IP para que coincida con la dirección IP del servidor de Asset Explorer. Esto permitirá a un atacante enviar una petición NEWSCAN a un agente de escucha en la red, así como recibir la petición HTTP del agente comprobando su authtoken. En el archivo httphandler.cpp, el agente que llega a través de HTTP es vulnerable a un Desbordamiento de Enteros, que puede convertirse en un Desbordamiento de Pila que permite la ejecución de código remota como NT AUTHORITY/SYSTEM en la máquina del agente. El Desbordamiento de Enteros ocurre cuando se recibe la respuesta POST del servidor Manage Engine, y el agente llama a \"HttpQueryInfoW\" para obtener el tamaño \"Content-Length\" de la petición POST entrante. Este tamaño es tomado, pero multiplicado a una cantidad mayor. Si un atacante especifica un tamaño de Content-Length de 1073741823 o mayor, esta aritmética de enteros envolverá el valor de vuelta a un entero más pequeño, y luego llama a \"calloc\" con este tamaño para asignar memoria. La siguiente API \"InternetReadFile\" copiará los datos de POST en este búfer, que será demasiado pequeño para el contenido, y causará un desbordamiento de pila"
    }
  ],
  "lastModified": "2026-06-17T03:33:17.337",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zohocorp:manageengine_assetexplorer:1.0.34:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2ED9862E-512A-4A1A-98F7-845ED9A62C44"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnreport@tenable.com"
}