Sploitus

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Zohocorp Manageengine Desktop Central

CVE-2022-23779

githubexploit · 2022-03-05

Exploit Code

README16 lines
## https://sploitus.com/exploit?id=9AAE5C13-9953-5553-B5A4-9DA9FB155DBD
# CVE-2022-23779: Internal Hostname Disclosure Vulnerability
## Information
**Description:** Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.  
**Versions Affected:** <10.1.2137.7 \
**Researcher:** Matthew Zellner (@fbusr)  
**Disclosure Link:** https://www.manageengine.com/products/desktop-central/cve-2022-23779.html  
**NIST CVE Link:** https://nvd.nist.gov/vuln/detail/CVE-2022-23779  

## Proof-of-Concept Exploit
### Description
1. Send an HTTP GET request to '/themes' over port 8020.
2. Read the HTTP redirect response and anaylze the 'Location' HTTP response header.  

### Usage/Exploitation
`./CVE-2022-23779.sh`