Zoho ManageEngine Network Configuration Manager/OpManager up to 12.3.213 ProcessRequest.do RequestXML xml external entity reference

Summaryinfo

A vulnerability labeled as critical has been found in Zoho ManageEngine Network Configuration Manager and OpManager up to 12.3.213. Impacted is an unknown function of the file /devices/ProcessRequest.do. Executing a manipulation of the argument RequestXML as part of GET Request can lead to xml external entity reference. This vulnerability is tracked as CVE-2018-18980. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Zoho ManageEngine Network Configuration Manager and OpManager up to 12.3.213 (Network Management Software) and classified as critical. This vulnerability affects an unknown part of the file /devices/ProcessRequest.do. The manipulation of the argument RequestXML as part of a GET Request leads to a xml external entity reference vulnerability. The CWE definition for the vulnerability is CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacker can trigger the transmission of local files to an arbitrary remote FTP server.

The bug was discovered 10/30/2018. The weakness was disclosed 11/06/2018 (Website). The advisory is shared for download at github.com. This vulnerability was named CVE-2018-18980 since 11/05/2018. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 6 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 12.3.214 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Network Management Software

Vendor

• Zoho ManageEngine

Name

• Network Configuration Manager
• OpManager

Version

• 12.3.213

License

• commercial

Website

• Vendor: https://www.manageengine.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion