Original
release date: December 2, 2021
CISA and the Federal Bureau of Investigation (FBI) have released a joint Cybersecurity
Advisory identifying active exploitation of a vulnerability—CVE-2021-44077—in
Zoho ManageEngine ServiceDesk Plus. CVE-2021-44077 is an unauthenticated remote
code execution vulnerability that affects all ServiceDesk Plus versions up to,
and including, version 11305.
This vulnerability was addressed by the update released by Zoho on September
16, 2021 for ServiceDesk Plus versions 11306 and above. If left unpatched,
successful exploitation of the vulnerability allows an attacker to upload
executable files and place webshells that enable post-exploitation activities,
such as compromising administrator credentials, conducting lateral movement,
and exfiltrating registry hives and Active Directory files. Zoho has set up a
security response plan center that provides additional details, a
downloadable tool that can be run on potentially affected systems, and a
remediation guide.
CISA encourages organizations to review the joint Cybersecurity
Advisory and apply the recommended mitigations immediately.