CVE-2022-35403: ManageEngine ServiceDesk Plus Disclosure

CVE-2022-35403 Overview

CVE-2022-35403 is an unauthenticated local file disclosure vulnerability affecting multiple Zoho ManageEngine products including ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus, and Asset Explorer. The vulnerability exists in the ticket-creation email functionality and allows remote attackers to read arbitrary local files from the server without requiring authentication. This represents a significant information disclosure risk for organizations running these IT service management platforms.

Critical Impact

Unauthenticated attackers can remotely access and disclose sensitive local files from vulnerable ManageEngine servers via the ticket-creation email functionality, potentially exposing configuration files, credentials, and other sensitive data.

Affected Products

• Zoho ManageEngine ServiceDesk Plus before version 13008
• Zoho ManageEngine ServiceDesk Plus MSP before version 10606
• Zoho ManageEngine SupportCenter Plus before version 11022
• Zoho ManageEngine Asset Explorer before version 6977 (requires authentication)

Discovery Timeline

• July 12, 2022 - CVE-2022-35403 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-35403

Vulnerability Analysis

This local file disclosure vulnerability exists in the email-based ticket creation mechanism of the affected ManageEngine products. The vulnerability allows unauthenticated remote attackers to read arbitrary files from the server's local file system by manipulating the ticket-creation email process. The attack requires no user interaction and can be executed entirely over the network, making it particularly dangerous for internet-exposed instances.

The confidentiality impact is substantial as attackers can potentially access sensitive configuration files, database credentials, application secrets, and other critical data stored on the server. However, the vulnerability does not allow modification of files or disruption of service availability.

It's worth noting that while ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus can be exploited without authentication, Asset Explorer requires authentication for successful exploitation, though this does not diminish the risk for authenticated users.

Root Cause

The root cause of this vulnerability lies in improper input validation and insufficient access controls within the email parsing and ticket-creation functionality. The application fails to properly sanitize or restrict file path references when processing incoming emails for ticket creation, allowing attackers to craft malicious emails that reference local file paths. The application then inadvertently includes the contents of these files in the ticket or response, enabling file disclosure.

Attack Vector

The attack is carried out remotely over the network by sending specially crafted emails to the ticket-creation email address configured in the ManageEngine application. An attacker can construct an email with malicious payloads that reference local file paths on the server. When the application processes this email to create a ticket, it reads and potentially exposes the contents of the referenced files.

The attack flow typically involves:

1. Identifying the target ManageEngine instance and its email-based ticket creation endpoint
2. Crafting a malicious email containing file path traversal sequences or direct file references
3. Sending the email to trigger ticket creation
4. Retrieving the exposed file contents through the created ticket or system response

Due to the unauthenticated nature of this vulnerability (except for Asset Explorer), no credentials or prior access is required to exploit it.

Detection Methods for CVE-2022-35403

Indicators of Compromise

• Unusual email patterns sent to the ServiceDesk ticket-creation email address containing file path references or traversal sequences like ../ or absolute paths
• Tickets created from external sources containing unexpected file contents or configuration data
• Abnormal access patterns to local files by the ManageEngine application process
• Log entries showing email processing errors or unusual file read operations

Detection Strategies

• Monitor inbound emails to the ticket-creation address for suspicious patterns including path traversal sequences, references to sensitive files like /etc/passwd, web.xml, or configuration files
• Implement email filtering rules to detect and quarantine emails containing potential file inclusion payloads
• Review application logs for unusual file access patterns or errors related to email processing
• Deploy network monitoring to identify anomalous traffic patterns to ManageEngine instances

Monitoring Recommendations

• Enable detailed logging for email processing and ticket creation in ManageEngine applications
• Configure alerts for tickets created from unknown or suspicious external email addresses
• Implement file integrity monitoring on sensitive configuration files and directories
• Monitor for unauthorized data exfiltration attempts from the ManageEngine server

How to Mitigate CVE-2022-35403

Immediate Actions Required

• Upgrade Zoho ManageEngine ServiceDesk Plus to version 13008 or later immediately
• Upgrade ServiceDesk Plus MSP to version 10606 or later
• Upgrade SupportCenter Plus to version 11022 or later
• Upgrade Asset Explorer to version 6977 or later
• Restrict network access to ManageEngine instances to trusted networks only

Patch Information

Zoho has released security patches addressing this vulnerability. Organizations should apply the following minimum versions to remediate CVE-2022-35403:

• ServiceDesk Plus: Version 13008 or later
• ServiceDesk Plus MSP: Version 10606 or later
• SupportCenter Plus: Version 11022 or later
• Asset Explorer: Version 6977 or later

For detailed patch information and download links, refer to the ManageEngine CVE-2022-35403 Advisory.

Workarounds

• If immediate patching is not possible, consider temporarily disabling email-based ticket creation until patches can be applied
• Implement strict email filtering rules to block potentially malicious emails before they reach the ManageEngine application
• Place ManageEngine instances behind a web application firewall (WAF) with rules to detect file inclusion attempts
• Restrict inbound email to the ticket-creation address to trusted domains only

# Example: Restrict access to ManageEngine instance via firewall
# Block public access to the email processing service
iptables -A INPUT -p tcp --dport 25 -s ! 10.0.0.0/8 -j DROP

# Limit access to the web interface to internal networks
iptables -A INPUT -p tcp --dport 8080 -s ! 192.168.0.0/16 -j DROP