CVE-2021-44652

Vulnerability

Zoho ManageEngine O365 Manager Plus before Build 4416 contains a remote code execution vulnerability in the ChangeDBAPI component. The issue allows an attacker to overwrite BCP (Bulk Copy Program) files, leading to arbitrary code execution. Affected versions are all prior to Build 4416 [1].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the ChangeDBAPI endpoint, causing an overwrite of a BCP file. No authentication is required, and the attack can be performed remotely over the network [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the target server with the privileges of the application, potentially leading to full system compromise, data theft, or further lateral movement [1].

Mitigation

The vulnerability is fixed in ManageEngine O365 Manager Plus Build 4416 and later. Administrators should upgrade to this build or higher immediately. No workarounds are documented [1].