CVE-2014-6038
published 2020-01-13CVE-2014-6038: Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0…
PriorityP269high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
72.76%
99.4th percentile
Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. Fixed in EventLog Analyzer 10.0 Build 10000.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zohocorp | manageengine_eventlog_analyzer | 7.0 – 9.9 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect unauthenticated GET requests to the agentHandler servlet with the mode=getTableData parameter, which allows reading arbitrary database tables without authentication. ↗
- →Detect unauthenticated GET requests to the hostdetails servlet with slid and hostid parameters, which discloses managed host superuser credentials. ↗
- →On EventLog Analyzer version 7, exploitation paths are prepended with /event/ — monitor for /event/agentHandler and /event/hostdetails request patterns in addition to the root-level paths. ↗
- →Credentials returned by the hostdetails servlet are XOR-encoded with 0x30 and base64-encoded; look for base64 blobs in HTTP responses from /hostdetails as an indicator of successful exploitation. ↗
- ·On EventLog Analyzer version 7, all exploit URLs must be prepended with /event/ (e.g., /event/agentHandler?... and /event/hostdetails?...) rather than the root path used in later versions. ↗
- ·No authentication or any other prior information is required to exploit CVE-2014-6038; the vulnerability is fully unauthenticated and pre-auth. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)
exploitdb·2014-11-05·CVSS 7.5
CVE-2014-6039 [HIGH] ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (2)
---
>> Multiple vulnerabilities in ManageEngine EventLog Analyzer
>> Discovered by Pedro Ribeiro ([email protected]), Agile Information Security
Disclosure: 05/11/2014 / Last updated: 05/11/2014
>> Background on the affected product:
"EventLog Analyzer provides the most cost-effective Security Information and Event Management (SIEM) software on the market. Using this Log Analyzer software, organizations can automate the entire process of managing terabytes of machine generated logs by collecting, analyzing, correlating, searching, reporting, and archiving from one central location. This event log analyzer software helps to monitor file integrity, conduct log forensics analysis, monitor privileged users and comply to different
Metasploit
ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure
metasploit·CVSS 7.5
CVE-2014-6038 [HIGH] ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure
ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure
ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that allow an unauthenticated user to obtain the superuser password of any managed Windows and AS/400 hosts. This module abuses both vulnerabilities to collect all the available usernames and passwords. First the agentHandler servlet is abused to get the hostid and slid of each device (CVE-2014-6038); then these numeric IDs are used to extract usernames and passwords by abusing the hostdetails servlet (CVE-2014-6039). Note that on version 7, the TARGETURI has to be prepended with /event.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/128996/ManageEngine-EventLog-Analyzer-SQL-Credential-Disclosure.htmlhttp://seclists.org/fulldisclosure/2014/Nov/12http://www.securityfocus.com/bid/70959https://exchange.xforce.ibmcloud.com/vulnerabilities/98540http://packetstormsecurity.com/files/128996/ManageEngine-EventLog-Analyzer-SQL-Credential-Disclosure.htmlhttp://seclists.org/fulldisclosure/2014/Nov/12http://www.securityfocus.com/bid/70959https://exchange.xforce.ibmcloud.com/vulnerabilities/98540
2020-01-13
Published