CVE-2020-11552

published 2020-08-11

CVE-2020-11552: An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges…

Priority P2 67 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. An unauthenticated attacker having physical access to the host could trigger a security alert by supplying a self-signed SSL certificate to the client. The View Certificate option from the security alert allows an attacker to export a displayed certificate to a file. This can further cascade to a dialog that can open Explorer as SYSTEM. By navigating from Explorer to \windows\system32, cmd.exe can be launched as a SYSTEM.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zohocorp	manageengine_adselfservice_plus	<= 5.8	—
zohocorp	manageengine_adselfservice_plus	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://www.youtube.com/watch?v=slZRXffswnQ↗

• → Monitor for cmd.exe or other shells spawned as SYSTEM from Explorer.exe, particularly when Explorer is a child of certificate/dialog-related processes on Windows login screen hosts running ADSelfService Plus thick client. ↗
• → Alert on self-signed SSL certificate presentation to the ADSelfService Plus thick client (Windows login screen self-service option), which triggers the exploitable security alert dialog. ↗
• → Detect certificate export operations initiated from the ADSelfService Plus thick client security alert dialog (View Certificate → export to file), which is the pivot point to open Explorer as SYSTEM. ↗
• → Flag exploitation attempts via RDP access in addition to physical access — attacker can trigger the certificate alert remotely over RDP to abuse the thick client dialog. ↗

• · The initial patch released on 11/03/2020 only partially fixed the issue; the complete fix was not available until build 6003 released on 24/07/2020. Systems patched before build 6003 may still be vulnerable. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269