CVE-2020-10189

This Metasploit module exploits a Java deserialization vulnerability in ManageEngine Desktop Central via the getChartImage() method in the FileStorage class. It uploads a serialized payload to trigger remote code execution on vulnerable versions (< 10.0.474).

This PoC exploits a deserialization vulnerability in ManageEngine Desktop Central via the CewolfServlet, allowing unauthenticated remote code execution as SYSTEM/root. The exploit leverages the MDMLogUploaderServlet to plant a malicious serialized file, which is then deserialized by the CewolfServlet.

This Metasploit module exploits a Java deserialization vulnerability (CVE-2020-10189) in ManageEngine Desktop Central versions < 10.0.474. It uploads a serialized payload via a path traversal and triggers deserialization to achieve remote code execution.