CVE-2020-9367
📋 TL;DR
This vulnerability allows DLL hijacking in Zoho ManageEngine Desktop Central MSP, enabling attackers to execute arbitrary code with SYSTEM privileges. It affects systems running the vulnerable MPS Agent component. Attackers can escalate privileges by placing a malicious DLL in a location where the application searches for it.
💻 Affected Systems
- Zoho ManageEngine Desktop Central MSP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM privilege escalation leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local privilege escalation allowing attackers to gain SYSTEM privileges on affected systems.
If Mitigated
Limited impact with proper file permissions and restricted user access preventing DLL placement.
🎯 Exploit Status
Exploitation requires ability to place malicious DLL in application search path. No authentication bypass needed beyond initial access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Build 10.0.487 and later
Vendor Advisory: https://www.manageengine.com/desktop-management-msp/dll-hijacking-vulnerability.html
Restart Required: Yes
Instructions:
1. Download latest version from ManageEngine website. 2. Stop Desktop Central MSP services. 3. Install update. 4. Restart services.
🔧 Temporary Workarounds
Restrict DLL search paths
windowsSet secure DLL search mode to prevent loading from current directory
reg add "HKLM\System\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f
Set restrictive file permissions
windowsPrevent unauthorized users from writing to Desktop Central MSP directories
icacls "C:\Program Files\ManageEngine\Desktop Central MSP" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Implement strict file system permissions on Desktop Central MSP directories
- Monitor for suspicious DLL creation in application directories
🔍 How to Verify
Check if Vulnerable:
Check if Desktop Central MSP version is 10.0.486 or earlier and CSUNSAPI.dll is missing from installation directoryCheck Version:
Check Help > About in Desktop Central MSP console or examine version.txt in installation directoryVerify Fix Applied:
Verify version is 10.0.487 or later and CSUNSAPI.dll is present or properly referenced📡 Detection & Monitoring
Log Indicators:
- Failed DLL loading attempts
- Unexpected process creation from dcinventory.exe or dcconfig.exe
Network Indicators:
- Unusual outbound connections from Desktop Central MSP processes
SIEM Query:
Process Creation where (Image contains 'dcinventory.exe' OR Image contains 'dcconfig.exe') AND CommandLine contains 'CSUNSAPI.dll'