cbcvebase.
CVE-2022-23779
published 2022-03-02

CVE-2022-23779: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP…

PriorityP344medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EXPLOIT
EPSS
15.14%
96.3th percentile
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.

Affected

1 ranges
VendorProductVersion rangeFixed in
zohocorpmanageengine_desktop_central< 10.1.2137.810.1.2137.8

Detection & IOCsextracted from sources · hover to see the quote

url/themes↗
othershodan: http.title:"manageengine desktop central 10"
otherfofa: app="ZOHO-ManageEngine-Desktop"
otherfofa: title="manageengine desktop central 10"
otherfofa: app="zoho-manageengine-desktop"
othergoogle: intitle:"manageengine desktop central 10"
  • →Send a GET request to /themes on the target. A 301 redirect response whose Location header contains an internal hostname (not matching the original Host) indicates the vulnerability is present.
  • →Check the HTTP response status code for 301 Moved Permanently.
  • →Inspect the Location response header: if it contains a hostname different from the requesting Host value, the internal server name is being disclosed.
  • →The Location header in the redirect response will contain the internal hostname in the form https?://<internal-host>:<port>. Extract the hostname using the regex: https?:\/\/(.*):
  • ·The vulnerability affects Zoho ManageEngine Desktop Central versions before 10.1.2137.8 only. Patched instances will not disclose the internal hostname via the redirect.
  • ·Detection requires that the Location header in the 301 redirect response does NOT match the Host header of the original request — a match means the server is not leaking an internal hostname.

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.