Get help with JNDI vulnerability CVE-2021-42392! Get CSW's Detection Script

Zoho: CISA and FBI Issues Alert for New Zero-Day Vulnerability (CVE-2021-44077), Patch Now!

Posted on Dec 24, 2021 | By Pavithra Shankar

An APT group is using CVE-2021-44077 and CVE-2021-44515 in Zoho ManageEngine ServiceDesk Plus and Desktop Central Servers to compromise businesses in a range of industries, including military and technology.

- Cyber Infrastructure Security Agency and FBI

On November 22, 2021, Zoho released an advisory alerting customers about the active exploitation of newly registered CVE-2021-44077 in ManageEngine ServiceDesk Plus. Zoho’s ManageEngine ServiceDesk Plus is an IT help desk and asset management software that provides a complete auditing trail of the service tickets associated with each asset.

APT Threat Groups Actively Seeking for Vulnerable ServiceDesk Systems

 

Over the three months since the disclosure of CVE-2021-40539, the threat actors have shifted their focus to a different Zoho product by leveraging the new vulnerability (CVE-2021-44077). Threat actors have been observed exploiting the CVE-2021-44077 unauthenticated, remote code execution issue affecting Zoho ServiceDesk Plus versions 11305 and older. 

 

On September 16, 2021, the Federal Bureau of Investigation (FBI), the United States Coast Guard Cyber Command (CGCYBER), and the Cybersecurity and Infrastructure Security Agency (CISA) first alerted the public about activity targeting CVE-2021-40539, stating that it was most likely APT activity and emphasizing the high risk these attacks posed to critical infrastructure. Following the joint alerts, Palo Alto Networks has published that they found traces of attacks linked to the Chinese APT27 (Emissary Panda) group, which has previously used Godzilla webshell. 

 

On December 17, FBI and CISA red-flagged another CVE identified as CVE-2021-44515 in Desktop Central servers that have been under active exploitation by Advanced Persistent Threats. 

 

To add on, following the exploitation, attackers are downloading a dropper to target systems. This dropper delivers a Godzilla webshell, which allows the actor with additional access to and persistence on compromised devices, similar to prior techniques used against the ADSelfService software.

 

The Looming Threats

 

CVE-2021-44077

 

  • CVE-2021-44077 is a remote code execution vulnerability in ManageEngine ServiceDesk Plus that is triggered by a security misconfiguration. 

  • This zero-day has been issued a CVSS v3 score of 9.8 (critical), impacting on-premises deployments up to version 11306.

  • Described as CWE-287 leading to Improper Authentication, which is the 14th most dangerous software weakness according to the 2021 CWE Top 15 Most Dangerous Software Weaknesses released by MITRE.

  • On December 02, 2021, CISA and FBI published an advisory to outline the cyber threat associated with active exploitation.

  • On December 15, 2021, a Proof-of-Concept was released on GitHub.

  • CISA had put up a list of Indicators of Compromise (IoCs), including tactics, techniques, and procedures.

  • Scanners such as Qualys, Tenable were able to detect this vulnerability.


 

 Qualys 

 Tenable 

 Nexpose 

 730291

 376137 

 155864 

 N/A

 

Global Exposure

 

A quick search on Shodan reveals that there are 7,143 instances on the Internet, providing a doorway to internal networks that are exposed to the world for anyone to try to break through. 


 

Google search interest indicates that this critical vulnerability has been trending since its discovery in countries such as Japan, the United Kingdom, the United States, and India.

 

Trending Regions


 

CVE-2021-44515

 

  • CVE-2021-44515 is a critical authentication bypass vulnerability attackers could exploit to execute arbitrary code on vulnerable Desktop Central servers. 

  • Issued a CVSS v3 score of 9.8 (critical) and a manifestation of CWE-287 (Improper Authentication), demonstrating its seriousness. 

  • According to the Shodan search engine, 3,011 instances of ManageEngine Desktop Central are exposed to the Internet, with around 41% of the instances being found in the United States alone.    

 

 

It is recommended that organizations upgrade their ManageEngine Desktop Central installations as soon as possible in order to prevent potential threats.


 

Vulnerable Products

 

CVE ID

Affected Products

CVE-2021-44077

Zoho ManageEngine Service Desk version upto 11305, Service Desk Plus MSP version upto 10529, SUpportCenter Plus version up to 11013

CVE-2021-44515 

Zoho ManageEngine Desktop Central version 10.1.2127.17 and below and 10.1.2128.0 to 10.1.2137.2, AssetExplorer versions upto 6952


 

Indicators of Compromise (IoCs) 

Type

Values

Hashes

Webshell:

67ee552d7c1d46885b91628c603f24b66a9755858e098748f7e7862a71baa015

068D1B3813489E41116867729504C40019FF2B1FE32AAB4716D429780E666324

759bd8bd7a71a903a26ac8d5914e5b0093b96de61bf5085592be6cc96880e088

262cf67af22d37b5af2dc71d07a00ef02dc74f71380c72875ae1b29a3a5aa23d

a44a5e8e65266611d5845d88b43c9e4a9d84fe074fd18f48b50fb837fa6e429d

ce310ab611895db1767877bd1f635ee3c4350d6e17ea28f8d100313f62b87382

75574959bbdad4b4ac7b16906cd8f1fd855d2a7df8e63905ab18540e2d6f1600

5475aec3b9837b514367c89d8362a9d524bfa02e75b85b401025588839a40bcb

Dropper:

ecd8c9967b0127a12d6db61964a82970ee5d38f82618d5db4d8eddbb3b5726b7

Implant:

009d23d85c1933715c3edcccb46438690a66eebbcccb690a7b27c9483ad9d0ac

083bdabbb87f01477f9cf61e78d19123b8099d04c93ef7ad4beb19f4a228589a

342e85a97212bb833803e06621170c67f6620f08cc220cf2d8d44dff7f4b1fa3

NGLite Backdoor:

805b92787ca7833eef5e61e2df1310e4b6544955e812e60b5f834f904623fd9f

3da8d1bfb8192f43cf5d9247035aa4445381d2d26bed981662e3db34824c71fd

5b8c307c424e777972c0fa1322844d4d04e9eb200fe9532644888c4b6386d755

3f868ac52916ebb6f6186ac20b20903f63bc8e9c460e2418f2b032a207d8f21d

342a6d21984559accbc54077db2abf61fd9c3939a4b09705f736231cbc7836ae

7e4038e18b5104683d2a33650d8c02a6a89badf30ca9174576bf0aff08c03e72

KDC Sponge:

3c90df0e02cc9b1cf1a86f9d7e6f777366c5748bd3cf4070b49460b48b4d4090

b4162f039172dcb85ca4b85c99dd77beb70743ffd2e6f9e0ba78531945577665

e391c2d3e8e4860e061f69b894cf2b1ba578a3e91de610410e7e9fa87c07304c

Malicious IIS Module:

bec067a0601a978229d291c82c35a41cd48c6fca1a3c650056521b01d15a72da

Renamed WinRAR:

d0c3d7003b7f5b4a3bd74a41709cfecfabea1f94b47e1162142de76aa7a063c7

Renamed csvde:

7d2780cd9acc516b6817e9a51b8e2889f2dec455295ac6e6d65a6191abadebff

Domains  

seed.nkn[.]org

Filepaths  

C:\ManageEngine\ServiceDesk\bin\msiexec.exe

C:\ManageEngine\ServiceDesk\lib\tomcat\tomcat-postgres.jar

C:\Windows\Temp\ScriptModule.dll

C:\ManageEngine\ServiceDesk\bin\ScriptModule.dll

C:\Windows\system32\ME_ADAudit.exe

c:\Users\[username]\AppData\Roaming\ADManager\ME_ADManager.exe

%ALLUSERPROFILE%\Microsoft\Windows\Caches\system.dat

C:\ProgramData\Microsoft\Crypto\RSA\key.dat

c:\windows\temp\ccc.exe


 

CISA added CVE-2021-44515 and CVE-2021-44077 to its Known Exploited Vulnerabilities Catalog on December 10, encouraging federal agencies to patch it by December 25, 2021, under Binding Operational Directive 22-01. To discover any compromises in their system, Zoho has provided additional details and a downloadable exploit detection tool. We urge users to patch these Zoho vulnerabilities as soon as possible.

csw

Secure your environment from cyber-attacks!

Know How

incognito