Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
An unauthenticated attacker can remotely run arbitrary code on a vulnerable Manage Engine ServiceDesk Plus server. A successful exploit can result in the attacker gaining control of the server and launching additional attacks on devices, deploying ransomware, or moving laterally across the network.
Kill Chain
Risk Score
83
ManageEngine ServiceDesk Plus is help desk software that enables IT administrators to manage assets. ServiceDesk Plus has a vulnerability that allows attackers to bypass authentication and upload a file with executable code. To exploit this vulnerability, the attacker creates a malicious HTTP POST request that includes a URI for a REST API endpoint and a query parameter (step=) to upload a malicious file, such as misexec.exe. The ManageEngine server sends an HTTP response with a 401 status code after the file is saved to the following location: C:\ManageEngine\Servicedesk\bin\msiexec.exe. The attacker then submits additional HTTP POST requests to run the code within the malicious file.
