CVE-2020-14008
HIGHManageEngine Applications Manager <= 14710 - Authenticated Remote Code Execution via JAR Upload
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2020-14008. PoCs published by Hodorsec, JackHars, 0x0d3ad.
AI-analyzed exploit summary This exploit leverages an authenticated RCE vulnerability in ManageEngine Applications Manager by uploading a malicious JAR file via directory traversal and triggering its execution through a WebLogic credential test. The JAR contains a reverse shell payload executed via the `weblogic.jndi.Environment` class.
Description
Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.
Exploits (3)
This exploit leverages an authenticated RCE vulnerability in ManageEngine Applications Manager by uploading a malicious JAR file via directory traversal and triggering its execution through a WebLogic credential test. The JAR contains a reverse shell payload executed via the `weblogic.jndi.Environment` class.
This exploit leverages a deserialization vulnerability in ManageEngine Applications Manager to execute a PowerShell reverse shell with SYSTEM privileges. It authenticates with provided credentials and sends a malicious payload via the RestAPI/LogReceiver endpoint.
This repository contains a functional exploit for CVE-2020-14008, an authenticated RCE vulnerability in Zoho ManageEngine Applications Manager. The exploit abuses a file upload mechanism to deploy a malicious JAR file, which is then executed via a Weblogic credential test feature.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H