Zoho ManageEngine Exploit Attempt - CVE-2021-44077

ManageEngine ServiceDesk Plus is help desk software that enables IT administrators to manage assets. ServiceDesk Plus has a vulnerability that allows attackers to bypass authentication and upload a file with executable code. To exploit this vulnerability, the attacker creates a malicious HTTP POST request that includes a URI for a REST API endpoint and a query parameter (step=) to upload a malicious file, such as misexec.exe. The ManageEngine server sends an HTTP response with a 401 status code after the file is saved to the following location: C:\ManageEngine\Servicedesk\bin\msiexec.exe. The attacker then submits additional HTTP POST requests to run the code within the malicious file.