mirror of
https://github.com/0xMarcio/cve.git
synced 2026-05-29 16:29:28 +02:00
marc
22 lines
1.7 KiB
Markdown
22 lines
1.7 KiB
Markdown
### [CVE-2020-11552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11552)
|
|
|
|
|
|
|
|
|
|
### Description
|
|
|
|
An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. An unauthenticated attacker having physical access to the host could trigger a security alert by supplying a self-signed SSL certificate to the client. The View Certificate option from the security alert allows an attacker to export a displayed certificate to a file. This can further cascade to a dialog that can open Explorer as SYSTEM. By navigating from Explorer to \windows\system32, cmd.exe can be launched as a SYSTEM.
|
|
|
|
### POC
|
|
|
|
#### Reference
|
|
- http://packetstormsecurity.com/files/158820/ManageEngine-ADSelfService-Plus-6000-Remote-Code-Execution.html
|
|
- http://seclists.org/fulldisclosure/2020/Aug/4
|
|
- http://seclists.org/fulldisclosure/2020/Aug/6
|
|
- https://www.exploit-db.com/exploits/48739
|
|
- https://www.manageengine.com
|
|
|
|
#### Github
|
|
- https://github.com/ARPSyndicate/cvemon
|
|
|