CVE-2021-31531

Vulnerability

Zoho ManageEngine ServiceDesk Plus MSP before version 10521 is vulnerable to Server-Side Request Forgery (SSRF). The vulnerability exists in an unidentified endpoint and can be triggered without authentication. Affected versions include all builds prior to 10521.

Exploitation

An attacker with network access to the application can exploit this SSRF by sending crafted HTTP requests to the vulnerable endpoint. The exact steps are not detailed in available references, but the attack likely involves manipulating URL parameters to force the server to make requests to internal or external resources.

Impact

Successful exploitation allows the attacker to make arbitrary HTTP requests from the server, potentially accessing internal systems, reading sensitive files, or bypassing firewall restrictions. This could lead to information disclosure or further compromise of the internal network.

Mitigation

Upgrade to ManageEngine ServiceDesk Plus MSP version 10521 or later, released on June 29, 2021 [1]. The vendor has addressed the vulnerability in this build. No workaround is documented; applying the update is the recommended action.