CVE-2020-14008

published 2020-09-04

CVE-2020-14008: Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to…

Priority P2 62 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

EXPLOIT

Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zohocorp	manageengine_applications_manager	<= 13.0	—
zohocorp	manageengine_applications_manager	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /index.do↗

url /j_security_check↗

url /common/serverinfo.do↗

url /Upload.do↗

url /adminAction.do↗

cookie JSESSIONID_APM_9090↗

path ./../working/classes/weblogic/version8/weblogic.jar↗

• → Detect authenticated POST requests to /Upload.do with a 'uploadDir' parameter containing directory traversal sequences (e.g., '../') targeting the Weblogic JAR drop path working/classes/weblogic/version8/ ↗
• → Monitor for creation or modification of weblogic.jar at the path ./../working/classes/weblogic/version8/weblogic.jar relative to the ManageEngine AppManager installation directory, as this is the malicious JAR drop location ↗
• → Alert on ManageEngine Applications Manager spawning outbound socket connections or child processes (e.g., /bin/sh, cmd.exe) from the JVM process, indicative of the reverse shell payload in the malicious JAR being executed via WeblogicReference.lookupMBeanServer() ↗
• → Detect calls to the Weblogic credential test endpoint (adminAction.do with credentialtest action) shortly after a JAR upload to /Upload.do, as the exploit triggers code execution via the credential test flow ↗

• · The exploit requires prior authentication as an admin user; unauthenticated exploitation is not possible for this CVE ↗
• · If direct directory traversal upload fails, the exploit falls back to uploading to the normal path and then creating/executing an admin task to move the JAR to the target Weblogic location; both upload paths should be monitored ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434