cnvd - cnvd-2023-00007

CNVD-2023-00007

Vulnerability from cnvd - Published: 2022-12-30

Title

ZOHO ManageEngine Device Control Plus存在未明漏洞

Description

ZOHO ManageEngine Device Control Plus是美国卓豪（ZOHO）公司的一款USB设备控制软件。用于控制、阻止和监视连接到计算机的所有可移动设备。 ZOHO ManageEngine Device Control Plus 10.1.2228.15版本存在安全漏洞，该漏洞源于可以通过使用虚拟机（VM）绕过USB限制。攻击者利用该漏洞在笔记本电脑或系统外部交换文件。

Severity

中

Formal description

目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： https://www.manageengine.com/device-control/how-to/device-control.html

Reference

https://nvd.nist.gov/vuln/detail/CVE-2022-47577

Impacted products

Name
Zoho ZOHO ManageEngine Device Control Plus 10.1.2228.15

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-47577",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-47577"
    }
  },
  "description": "ZOHO ManageEngine Device Control Plus\u662f\u7f8e\u56fd\u5353\u8c6a\uff08ZOHO\uff09\u516c\u53f8\u7684\u4e00\u6b3eUSB\u8bbe\u5907\u63a7\u5236\u8f6f\u4ef6\u3002\u7528\u4e8e\u63a7\u5236\u3001\u963b\u6b62\u548c\u76d1\u89c6\u8fde\u63a5\u5230\u8ba1\u7b97\u673a\u7684\u6240\u6709\u53ef\u79fb\u52a8\u8bbe\u5907\u3002\n\nZOHO ManageEngine Device Control Plus 10.1.2228.15\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u53ef\u4ee5\u901a\u8fc7\u4f7f\u7528\u865a\u62df\u673a\uff08VM\uff09\u7ed5\u8fc7USB\u9650\u5236\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7b14\u8bb0\u672c\u7535\u8111\u6216\u7cfb\u7edf\u5916\u90e8\u4ea4\u6362\u6587\u4ef6\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a\r\nhttps://www.manageengine.com/device-control/how-to/device-control.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-00007",
  "openTime": "2022-12-30",
  "products": {
    "product": "Zoho ZOHO ManageEngine Device Control Plus 10.1.2228.15"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-47577",
  "serverity": "\u4e2d",
  "submitTime": "2022-12-26",
  "title": "ZOHO ManageEngine Device Control Plus\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2022-47577 (GCVE-0-2022-47577)

Vulnerability from cvelistv5 – Published: 2022-12-20 00:00 – Updated: 2024-08-03 14:55

Summary

An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor's position is "it's not a vulnerability in our product."

Severity ?

7.1 (High)


                        
                          CVSS:3.1/AC:L/AV:L/A:N/C:H/I:H/PR:L/S:U/UI:N

CWE

Assigner

mitre

References

URL

Tags

	https://medium.com/nestedif/vulnerability-disclos…
	https://www.manageengine.com/device-control/how-t…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-47577",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-03T17:48:09.788539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-03T17:48:16.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:55:08.395Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.manageengine.com/device-control/how-to/device-control.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor\u0027s position is \"it\u0027s not a vulnerability in our product.\""
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AC:L/AV:L/A:N/C:H/I:H/PR:L/S:U/UI:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-27T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://medium.com/nestedif/vulnerability-disclosure-business-logic-unauthorized-data-exfiltration-bypassing-dlp-zoho-cc51465ba84a"
        },
        {
          "url": "https://www.manageengine.com/device-control/how-to/device-control.html"
        }
      ],
      "tags": [
        "disputed"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-47577",
    "datePublished": "2022-12-20T00:00:00",
    "dateReserved": "2022-12-19T00:00:00",
    "dateUpdated": "2024-08-03T14:55:08.395Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2023-00007

CVE-2022-47577 (GCVE-0-2022-47577)

Tags

Sightings

Nomenclature