Vulnerability Description
Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation), the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process, AEAgent.cpp allocates 0x66 bytes using "malloc". This memory is never free-ed in the program, causing a memory leak. Additionally, the instruction sent to aeagent (ie: NEWSCAN, DELTASCAN, etc) is converted to a unicode string, but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Manageengine Assetexplorer | 1.0.34 |
Related Weaknesses (CWE)
References
- https://www.tenable.com/security/research/tra-2021-29Third Party Advisory
- https://www.tenable.com/security/research/tra-2021-29Third Party Advisory
FAQ
What is CVE-2021-20108?
CVE-2021-20108 is a vulnerability with a CVSS score of 7.5 (HIGH). Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on th...
How severe is CVE-2021-20108?
CVE-2021-20108 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-20108?
Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Manageengine Assetexplorer.