CVE-2014-5007
📋 TL;DR
This vulnerability allows remote attackers to write and execute arbitrary files with SYSTEM privileges in ZOHO ManageEngine Desktop Central. Attackers exploit a directory traversal flaw in the agentLogUploader servlet using '..' sequences in filename parameters. Affects Desktop Central and Desktop Central MSP editions before version 9 build 90055.
💻 Affected Systems
- ZOHO ManageEngine Desktop Central
- ZOHO ManageEngine Desktop Central MSP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing attackers to install malware, steal credentials, pivot to other systems, and maintain persistent access.
Likely Case
Remote code execution leading to data theft, ransomware deployment, or lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation, but still significant if exploited due to SYSTEM privileges.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9 build 90055 or later
Vendor Advisory: https://www.manageengine.com/products/desktop-central/remote-code-execution.html
Restart Required: Yes
Instructions:
1. Download Desktop Central version 9 build 90055 or later from ManageEngine website
2. Backup current installation and configuration
3. Run the installer to upgrade
4. Restart the Desktop Central service
🔧 Temporary Workarounds
Disable agentLogUploader servlet
allTemporarily disable the vulnerable servlet to block exploitation
Modify web.xml configuration to remove or comment out agentLogUploader servlet mapping
Network access control
allRestrict access to Desktop Central web interface
Configure firewall rules to limit access to trusted IP addresses only
🧯 If You Can't Patch
- Immediately isolate affected systems from internet and restrict internal network access
- Implement strict network segmentation and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Desktop Central version in web interface or installation directory. Versions before 9 build 90055 are vulnerable.Check Version:
Check Help > About in Desktop Central web interface or examine build number in installation directoryVerify Fix Applied:
Verify version is 9 build 90055 or later and test that agentLogUploader servlet no longer accepts directory traversal sequences.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /agentLogUploader with '..' sequences in parameters
- Unusual file creation in system directories
- SYSTEM privilege escalation events
Network Indicators:
- HTTP POST requests to /agentLogUploader with suspicious filename parameters
- Unexpected outbound connections from Desktop Central server
SIEM Query:
source="desktop-central" AND (uri_path="/agentLogUploader" AND (filename="*..*" OR parameter="*..*"))