1. Introduction
ManageEngine AssetExplorer uses default administrative credentials, allowing remote attackers to gain access to its management interface. This poses a High severity risk to businesses as it could lead to unauthorized control of the application and potentially the underlying systems it manages. Systems running ManageEngine AssetExplorer are typically affected. A successful exploit can compromise confidentiality, integrity, and availability of data managed by the application.
2. Technical Explanation
The vulnerability occurs because the AssetExplorer application is shipped with a default username (‘administrator’) and password (‘administrator’). An attacker who knows these credentials can log in to the web interface without authentication. There is no CVE associated with this specific issue, but it falls under CWE-798: Use of Hardcoded Credentials. A simple example would be an attacker using a brute force tool or directly attempting to login with the default credentials from any network location.
- Root cause: The application uses hardcoded, weak default credentials for administrative access.
- Exploit mechanism: An attacker attempts to log in to the AssetExplorer web interface using the ‘administrator’ / ‘administrator’ credentials. If successful, they gain full administrative control of the application.
- Scope: ManageEngine AssetExplorer applications are affected. Specific versions were not provided in the context.
3. Detection and Assessment
You can confirm if a system is vulnerable by checking the login page or attempting to log in with default credentials. A thorough method involves reviewing application configurations for custom credentials.
- Quick checks: Access the AssetExplorer web interface and observe whether it prompts for username/password without requiring any initial setup.
- Scanning: Nessus plugin ID 16478 can detect this vulnerability, but results should be verified manually.
- Logs and evidence: Check application logs for successful logins using the ‘administrator’ account. Log file locations vary depending on installation settings.
4. Solution / Remediation Steps
The solution involves logging into the application and changing the default login credentials. These steps should be performed as soon as possible.
4.1 Preparation
- Dependencies: No specific dependencies are required, but ensure you have access to the application’s web interface and administrative privileges. A roll back plan involves restoring from the backup if issues occur.
- Change window: This change can be performed during normal business hours with minimal impact. Approval is not typically needed for this low-risk change.
4.2 Implementation
- Step 1: Log in to the AssetExplorer web interface using the default credentials (‘administrator’ / ‘administrator’).
- Step 2: Navigate to the “Admin” or “Settings” section (the exact location may vary depending on the version).
- Step 3: Locate the “Change Password” option.
- Step 4: Enter a strong, unique password for the ‘administrator’ account and confirm it.
- Step 5: Save the changes.
4.3 Config or Code Example
Before
After
4.4 Security Practices Relevant to This Vulnerability
Several security practices can help prevent this type of issue. Least privilege reduces the impact if an account is compromised. Safe defaults ensure applications are not shipped with easily guessable credentials. A strong password policy enforces complex passwords, making brute-force attacks more difficult.
- Practice 1: Implement least privilege to limit access rights for all accounts.
- Practice 2: Enforce safe defaults by requiring custom configurations during initial setup.
4.5 Automation (Optional)
Automation is not recommended for this specific vulnerability due to the UI-based nature of the change and potential for errors.
5. Verification / Validation
- Post-fix check: Attempt to log in using the default credentials (‘administrator’ / ‘administrator’). The login should fail, and an error message should be displayed.
- Re-test: Repeat step 1 of the Detection and Assessment section. It should no longer be possible to log in with default credentials.
- Smoke test: Verify that you can access asset lists, reports, and other key application features using the new administrative account.
- Monitoring: Monitor application logs for failed login attempts using the ‘administrator’ account.
6. Preventive Measures and Monitoring
Update security baselines to include a requirement for custom credentials during initial setup. Implement CI/CD pipeline checks to prevent deployments with default configurations. Establish a regular patch or configuration review cycle to identify and address similar vulnerabilities.
- Baselines: Update your security baseline to require changing default passwords on all new applications.
- Pipelines: Add automated checks in your deployment pipelines to scan for hardcoded credentials or default settings.
7. Risks, Side Effects, and Roll Back
- Risk or side effect 1: Forgetting the new password could lead to temporary service disruption. Mitigation: Document the new password securely and establish a password reset procedure.
8. References and Resources
- Vendor advisory or bulletin: https://www.manageengine.com/products/asset-explorer/