CVE-2023-2291

Vulnerability

Hardcoded credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360 [1]. Specifically, the PostgreSQL database server uses a static password Stonebraker for the postgres superuser account, which is accessible from localhost [1]. This allows any local user to connect to the database and execute arbitrary SQL commands.

Exploitation

An attacker with low-privileged access to the local system can connect to the PostgreSQL database using the known credentials: psql -h 127.0.0.1 -p 4567 -d AMP -U postgres. From there, they can leverage the COPY ... FROM PROGRAM functionality to execute operating system commands as the SYSTEM account [1]. For example, they can create a table, copy the output of a command like whoami into it, and retrieve the result [1].

Impact

By executing arbitrary SQL and OS commands, the attacker can modify configuration data stored in the database, leading to privilege escalation from a low-privileged user to an Administrative user [1]. The SYSTEM account, while not a direct member of the Administrators group, can be used to alter administrative settings and grant full control over the application.

Mitigation

As of the publication date (2023-04-26), no official fix has been announced by Zoho [1]. Affected organizations should restrict network access to the PostgreSQL database port (default 4567) to only trusted hosts and ensure that only authorized personnel have local access to the server. Additionally, consider using firewall rules or application-level authentication to prevent unauthorized database connections.