ManageEngine Endpoint Central Unauthenticated SAML RCE

ManageEngine Endpoint Central Unauthenticated SAML RCE

Description

This exploits an unauthenticated remote code execution vulnerability that affects Zoho ManageEngine Endpoint Central and MSP versions 10.1.2228.10 and below (CVE-2022-47966). Due to a dependency to an outdated library (Apache Santuario version 1.4.1), it is possible to execute arbitrary code by providing a crafted `samlResponse` XML to the Endpoint Central SAML endpoint. Note that the target is only vulnerable if it is configured with SAML-based SSO , and the service should be active.

Author(s)

• Khoa Dinh
• horizon3ai
• Christophe De La Fuente
• h00die-gr3y <[email protected]>

Platform

Java,Windows

Development

• Source Code
• History