BLOG: 12 Vulnerabilities of Christmas CVE-2020-10189

Day three of our Christmas vulnerability countdown looks a vulnerability in Zoho ManageEngine. This CVE was targeted to great effect by Chinese state actors, particularly targeting Managed Service Providers (MSPs) for supply chain compromises.

CVE-2020-10189 is a critical vulnerability affecting Zoho’s ManageEngine Desktop Central software, which enables large organisations to manage fleets of corporate devices, including pushing software updates, locking users, taking over their screens for IT support and other feature. Attackers who compromise Desktop Central servers by exploiting this vulnerability would hence be able to control an organisation’s fleet of devices, which may incur potentially catastrophic consequences for lateral movement among corporate networks and devices.

The vulnerability was published on 5 March, 2020. A Metasploit module for related exploits was published a week later on 14 March, allowing threat actors to easily leverage the vulnerability to breach organisations’ Desktop Central servers.

Evidence of active exploitation in the wild came shortly afterwards. Concerns that the vulnerability could be leveraged by ransomware groups to move laterally between the compromised MangeEngine server and corporate devices were swiftly realised. On 28 April, Microsoft published a security advisory stating that it strongly advised companies to patch CVE-2020-10189 in the context of a wave of ransomware attacks against hospitals and other organisations in the health sector.

Concrete evidence of exploitation in the wild surfaced on 25 March  with reports of the vulnerability being exploited by APT41, a sophisticated threat actor conducing cyber espionage operations on behalf of the Chinese state. In one such campaign targeting MSPs between January and March 2020, the group was observed successfully leveraging CVE-2020-10189 against organisations as soon as 8 March , days after the initial proof-of-concept for the exploit was released. MSPs have become favourable targets for both state espionage campaigns and ransomware groups as they can facilitate supply-chain compromise of MSPs’ customers, allowing the threat actor to reach multiple victims simultaneously and stealthily.

Interest amongst threat actors was demonstrated early on following the initial disclosure of the vulnerability. Cybercriminals on underground forums registered interest in exploiting the vulnerability on dark web and underground hacking forums, with threads like the one below exploring how to  exploit CVE-2020-10189 using Metasploit.

Figure 1: A thread providing instructions on exploiting CVE-2020-10189 using Metasploit on a Turkish hacking forum 

With the high potential of ransomware groups and state espionage units exploiting the vulnerability for rapid lateral movement within organisations’ networks and devices, and the presence of a number of vulnerable hosts worldwide, we advise organisations follow these steps:

• Obfuscate HTTP banners to avoid active reconnaissance of these instances by opportunistic threat actors
• Upgrade to the latest version of Desktop Central, as the vulnerability affects versions prior to 10.0.479.
• Follow the further steps outlined by ManageEngine on their website in order to restore compromised instances and stop further lateral movement.