CVE-2021-20108 Information

Description

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed (due to authtoken validation) the Asset Explorer agent will reach out to the manage engine server for an HTTP request. During this process AEAgent.cpp allocates 0x66 bytes using \malloc. This memory is never free-ed in the program causing a memory leak. Additionally the instruction sent to aeagent (ie: NEWSCAN DELTASCAN etc) is converted to a unicode string but is never freed. These memory leaks allow a remote attacker to exploit a Denial of Service scenario through repetitively sending these commands to an agent and eventually crashing it the agent due to an out-of-memory condition.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

https://www.tenable.com/security/research/tra-2021-29

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5