Attack Chain

1. Authenticate to ManageEngine Applications Manager using valid credentials (e.g., default credentials) to obtain a session cookie.
2. Enumerate the ManageEngine base installation directory.
3. Create a malicious Java class (e.g., weblogic.jndi.Environment) containing a reverse shell.
4. Compile the Java class into a JAR file (e.g., weblogic.jar) using javac and jar.
5. Upload the malicious JAR file to the classes/weblogic/version8/ directory using directory traversal techniques. As a fallback, create a scheduled task to move the file.
6. Trigger the Weblogic credential test at the /testCredential.do endpoint.
7. The application loads and instantiates the malicious Java class.
8. The reverse shell within the JAR connects back to the attacker’s listener, granting remote code execution.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the affected system, potentially leading to complete system compromise, data theft, and disruption of services. Organizations using ManageEngine Applications Manager are at risk. The exploitation could lead to lateral movement within the network and further compromise of sensitive data.

Recommendation

• Apply the security updates provided by ManageEngine to patch CVE-2020-14008 as detailed in the ManageEngine Advisory.
• Deploy the Sigma rule for detecting JAR file uploads to the webserver log and tune for your environment.
• Monitor process creation events for Java processes executing from the classes/weblogic/version8/ directory, using the provided Sigma rule.
• Enforce strong password policies and regularly audit user accounts to prevent the use of default credentials, as mentioned in the overview.