Skip to content

Commit ddda0b2

Browse files
committed
Beautify metadata
1 parent 3768cf0 commit ddda0b2

File tree

1 file changed

+23
-24
lines changed

1 file changed

+23
-24
lines changed

modules/exploits/multi/http/manageengine_auth_upload.rb

Lines changed: 23 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -12,51 +12,50 @@ class Metasploit3 < Msf::Exploit::Remote
1212

1313
def initialize(info = {})
1414
super(update_info(info,
15-
'Name' => 'ManageEngine ServiceDesk / AssetExplorer / SupportCenter / IT360 Authenticated File Upload',
16-
'Description' => %q{
17-
This module exploits a directory traversal vulnerability in ManageEngine ServiceDesk /
18-
AssetExplorer / SupportCenter / IT360 when uploading attachment files. The JSP that accepts
15+
'Name' => 'ManageEngine Multiple Products Authenticated File Upload',
16+
'Description' => %q{
17+
This module exploits a directory traversal vulnerability in ManageEngine ServiceDesk,
18+
AssetExplorer, SupportCenter and IT360 when uploading attachment files. The JSP that accepts
1919
the upload does not handle correctly '../' sequences, which can be abused to write
20-
anywhere in the file system.
21-
Authentication is needed to exploit this vulnerability, but this module will attempt
22-
to login using the default credentials for the administrator and guest accounts;
23-
alternatively you can provide a pre-authenticated cookie or a username / password combo.
24-
For IT360 targets enter the RPORT of the ServiceDesk instance (usually 8400).
25-
All versions of ServiceDesk prior v9 build 9031 (including MSP but excluding v4), AssetExplorer,
20+
in the file system. Authentication is needed to exploit this vulnerability, but this module
21+
will attempt to login using the default credentials for the administrator and guest
22+
accounts. Alternatively you can provide a pre-authenticated cookie or a username / password
23+
combo. For IT360 targets enter the RPORT of the ServiceDesk instance (usually 8400). All
24+
versions of ServiceDesk prior v9 build 9031 (including MSP but excluding v4), AssetExplorer,
2625
SupportCenter and IT360 (including MSP) are vulnerable. At the time of release of this
2726
module, only ServiceDesk v9 has been fixed in build 9031 and above. This module has been
2827
been tested successfully in Windows and Linux on several versions.
2928
},
30-
'Author' =>
29+
'Author' =>
3130
[
3231
'Pedro Ribeiro <pedrib[at]gmail.com>', # Vulnerability Discovery and Metasploit module
3332
],
34-
'License' => MSF_LICENSE,
35-
'References' =>
33+
'License' => MSF_LICENSE,
34+
'References' =>
3635
[
37-
[ 'CVE', '2014-5301' ],
38-
[ 'OSVDB', '116733' ],
39-
[ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_sd_file_upload.txt' ],
40-
[ 'URL', 'http://seclists.org/fulldisclosure/2015/Jan/5' ]
36+
['CVE', '2014-5301'],
37+
['OSVDB', '116733'],
38+
['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_sd_file_upload.txt'],
39+
['URL', 'http://seclists.org/fulldisclosure/2015/Jan/5']
4140
],
4241
'DefaultOptions' => { 'WfsDelay' => 30 },
43-
'Privileged' => false, # Privileged on Windows but not on Linux targets
44-
'Platform' => 'java',
45-
'Arch' => ARCH_JAVA,
46-
'Targets' =>
42+
'Privileged' => false, # Privileged on Windows but not on Linux targets
43+
'Platform' => 'java',
44+
'Arch' => ARCH_JAVA,
45+
'Targets' =>
4746
[
4847
[ 'Automatic', { } ],
49-
[ 'ServiceDesk Plus v5-v7.1 < b7016/AssetExplorer v4/SupportCenter v5-v7.9 - Java Universal',
48+
[ 'ServiceDesk Plus v5-v7.1 < b7016/AssetExplorer v4/SupportCenter v5-v7.9',
5049
{
5150
'attachment_path' => '/workorder/Attachment.jsp'
5251
}
5352
],
54-
[ 'ServiceDesk Plus/Plus MSP v7.1 >= b7016 - v9.0 < b9031/AssetExplorer v5-v6.1 - Java Universal',
53+
[ 'ServiceDesk Plus/Plus MSP v7.1 >= b7016 - v9.0 < b9031/AssetExplorer v5-v6.1',
5554
{
5655
'attachment_path' => '/common/FileAttachment.jsp'
5756
}
5857
],
59-
[ 'IT360 v8-v10.4 - Java Universal',
58+
[ 'IT360 v8-v10.4',
6059
{
6160
'attachment_path' => '/common/FileAttachment.jsp'
6261
}

0 commit comments

Comments
 (0)