Nation-state actors are exploiting Zoho zero-day CVE-2021-44515 since October, FBI warns

The FBI warns that zero-day flaw in Zoho’s ManageEngine Desktop Central has been under active exploitation by nation-state actors since October.

The Federal Bureau of Investigation (FBI) revealed that the critical CVE-2021-44515 zero-day vulnerability in Zoho’s ManageEngine Desktop Central has been under active exploitation by nation-state actors since at least October.

The CVE-2021-44515 flaw is an authentication bypass vulnerability in ManageEngine Desktop Central software that can be exploited by attackers to bypass authentication and execute arbitrary code on Desktop Central servers.

“Since at least late October 2021, APT actors have been actively exploiting a zero-day, now identified as CVE-2021-44515, on ManageEngine Desktop Central servers.” reads the flash alert published by the FBI. “The APT actors were observed compromising Desktop Central servers, dropping a webshell that overrides a legitimate function of Desktop Central, downloading post-exploitation tools, enumerating domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials.”

Zoho addressed the flaw early this month and CISA added CVE-2021-44515 to the Known Exploited Vulnerabilities Catalog ordering federal agencies to address it before Christmas,

Querying the Shodan search engine for instances of ManageEngine Desktop Central exposed online, we can find more that 2980 systems.

The Flash alert includes Indicators of Compromise (IoCs) and Yara rules for these attacks along with Tactics, Techniques, and Procedures and mitigations.

“Organizations that identify any activity related to these IOCs within their networks should take action immediately. Zoho released a ManageEngine Desktop Central Security Advisory for the newly identified vulnerability CVE-2021-44515 on December 3, 2021:”

https://www.manageengine.com/products/desktop-central/cve-2021-44515-authenticationbypass-filter-configuration.html

Zoho also provided the following vulnerable build numbers for ManageEngine Desktop Central
customers:
For Enterprise Customers:
For builds 10.1.2127.17 and below, upgrade to 10.1.2127.18
For builds 10.1.2128.0 to 10.1.2137.2, upgrade to 10.1.2137.3
For MSP Customers:
For builds 10.1.2127.17 and below, upgrade to 10.1.2127.18 For builds 10.1.2128.0 to 10.1.2137.2, upgrade to 10.1.2137.3

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Zoho)

[adrotate banner=”5″]

[adrotate banner=”13″]