CVE-2018-11808 : Security Advisory and Response

A vulnerability in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows attackers to manipulate access control, potentially leading to unauthorized file deletion and access.

Understanding CVE-2018-11808

This CVE involves a security flaw in Zoho ManageEngine Applications Manager that could be exploited by attackers to compromise the system's integrity.

What is CVE-2018-11808?

The vulnerability in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows attackers to delete files and gain read access to specific files on the server by sending a specially crafted request.

The Impact of CVE-2018-11808

Exploiting this vulnerability enables attackers to delete files and access certain files on the server within the user context, typically set as "NT AUTHORITY / SYSTEM."

Technical Details of CVE-2018-11808

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The vulnerability exists in the CustomFieldsFeedServlet of Zoho ManageEngine Applications Manager, leading to incorrect access control.

Affected Systems and Versions

Product: Zoho ManageEngine Applications Manager Version 13 before build 13740
Vendor: Zoho
Version: All versions before build 13740

Exploitation Mechanism

Attackers can exploit this vulnerability by sending a specifically crafted request to the server, allowing them to delete files and gain unauthorized access.

Mitigation and Prevention

Protecting systems from CVE-2018-11808 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply security updates and patches provided by Zoho ManageEngine promptly.
Monitor system logs for any suspicious activities.
Restrict network access to the affected system.

Long-Term Security Practices

Implement the principle of least privilege to restrict user access.
Conduct regular security audits and penetration testing.
Educate users on safe computing practices to prevent social engineering attacks.

Patching and Updates

Regularly check for security updates and patches from Zoho ManageEngine to address vulnerabilities like CVE-2018-11808.