CVE-2022-23050

Deeper analysis

ManageEngine AppManager15 (Build No:15510) contains a DLL hijacking vulnerability tracked as CVE-2022-23050 and assigned CWE-427. An authenticated administrator can use the product's "Upload Files / Binaries" feature to place an arbitrary DLL inside the application's "working" folder, after which the process loads the attacker-controlled library because of an uncontrolled search path element.

An attacker who already possesses administrative credentials can therefore upload a malicious DLL over the network and obtain arbitrary code execution with the privileges of the AppManager service, resulting in full compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.2 reflects the need for high privileges while confirming that no user interaction or additional attack complexity is required once those credentials are obtained.

ManageEngine published a security advisory and corresponding patch that addresses the issue for AppManager15; the Fluid Attacks advisory provides technical reproduction steps and confirms the same vector. The EPSS score has remained flat at 0.2737 with no material increase after disclosure.