How To Fix CVE-2021-44515- An Authentication Bypass Vulnerability In Desktop Central And Desktop Central MSP

Zoho, an enterprise software provider belles about an authentication bypass vulnerability in its Desktop Central, and Desktop Central MSP is actively exploited in the wild. The flaw which is being tracked as CVE-2021-44515 allows an attacker to bypass authentication and execute arbitrary code in the affected products. Let’s see how to fix CVE-2021-44515 to protect your Desktop Central and Desktop Central MSP from being compromised.

Table of Contents

Summary Of The CVE-2021-44515 An Authentication Bypass Vulnerability:

The vendor has concluded the severity of the vulnerability is Critical as it allows the attacker to bypass authentication and execute arbitrary code in Desktop Central and Desktop Central MSP servers.

Products Affected By An Authentication Bypass Vulnerability (CVE-2021-44515):

As per the report published on 3rd Dec 2021, version builds less than 10.1.2127.17 and 10.1.2128.0 to 10.1.2137.2 are affected by the Authentication Bypass Vulnerability (CVE-2021-44515). It is recommended to upgrade the products to versions 10.1.2127.18 & 10.1.2137.3.

Fix Build:-
For Enterprise:
For builds 10.1.2127.17 and below, upgrade to 10.1.2127.18
For builds 10.1.2128.0 to 10.1.2137.2, upgrade to 10.1.2137.3
For MSP:
For builds 10.1.2127.17 and below, upgrade to 10.1.2127.18
For builds 10.1.2128.0 to 10.1.2137.2, upgrade to 10.1.2137.3

How To Validate Your Desktop Central Is Vulnerable To The CVE-2021-44515 Vulnerability?

The vendor has developed Exploit Detection Tool, which will tell you if your product is vulnerable to the authentication bypass vulnerability.
Follow these steps in order to validate your product is vulnerable to the CVE-2021-44515 vulnerability:

Download the Exploit Detection Tool to the server on which Desktop Central or Desktop Central MSP is installed.
extract the Exploit detection Tool to either /ManageEngine/UEMS_CentralServer/bin folder or /ManageEngine/DesktopCentral_Server/bin folder whichever is applicable for you.
Change the directory to either /ManageEngine/UEMS_CentralServer/bin folder or /ManageEngine/DesktopCentral_Server/bin folder.
Run the command RCEScan.bat
You will either see “Compromised” or “Not Compromised” as the output. As it clearly says that, If you see “Not Compromised,” your product is not vulnerable, your are safe, and no action is required, but if you see “Compromised,” then you should plan for upgradation to fix CVE-2021-44515, the authentication bypass vulnerability.