1. Introduction
ManageEngine NCM 12.5.x < 12.5.658 / 12.6.x < 12.6.003 / 12.6.... is affected by a Remote Code Execution vulnerability in the web server application. This allows authenticated users to make database changes that could lead to attackers running code on your systems. Systems running ManageEngine NCM within the specified versions are at risk. A successful exploit could compromise confidentiality, integrity and availability of the affected system.
2. Technical Explanation
ManageEngine NCM 12.5.x prior to 12.5.658, or 12.6.x prior to 12.6.003 / 12.6.105 / 12.6.120 allows authenticated users to make database changes that can lead to remote code execution. The vulnerability stems from insufficient input validation when handling database modifications. An attacker with valid credentials could inject malicious SQL commands or alter the database structure in a way that enables code execution.
- Root cause: Insufficient input validation on database modification requests.
- Exploit mechanism: Authenticated users can submit crafted requests to modify the NCM database, potentially injecting malicious code.
3. Detection and Assessment
To confirm vulnerability, check the installed version of ManageEngine NCM. A thorough assessment involves reviewing application logs for suspicious database modification attempts.
- Quick checks: Check the product version through the web interface (usually under Help -> About).
- Scanning: Nessus plugin ID 62d74383 can be used to detect vulnerable versions. This relies on self-reported version numbers.
- Logs and evidence: Review NCM application logs for database modification events, looking for unusual or unexpected queries.
# No command available as this requires access to the ManageEngine NCM web interface. Check Help -> About section.4. Solution / Remediation Steps
Apply the latest patch from the vendor to address the vulnerability. Follow these steps for a safe upgrade.
4.1 Preparation
- Ensure you have downloaded the correct patch version for your installation. A roll back plan involves restoring from the pre-update database backup.
- A change window may be required, depending on your organisation’s policies. Approval from a system owner might be needed.
4.2 Implementation
- Step 1: Download the latest patch for ManageEngine NCM from the vendor’s website.
- Step 2: Stop the ManageEngine NCM service.
- Step 3: Install the downloaded patch following the vendor’s instructions.
- Step 4: Start the ManageEngine NCM service.
4.3 Config or Code Example
No config change is required, this vulnerability is fixed by upgrading to a patched version.
Before
N/A - Vulnerable VersionAfter
N/A - Patched Version (12.5.658 or later, or 12.6.003 / 12.6.105 / 12.6.120 or later)4.4 Security Practices Relevant to This Vulnerability
Practices such as least privilege and input validation can help mitigate the risk of remote code execution vulnerabilities.
- Practice 1: Implement least privilege access controls to limit user permissions, reducing the impact if an account is compromised.
- Practice 2: Enforce strict input validation on all data received by web applications to prevent malicious code injection.
4.5 Automation (Optional)
No automation script provided as this requires vendor specific patching tools.
N/A - Requires Vendor Specific Patching Tools5. Verification / Validation
Confirm the fix by verifying the installed patch version and performing a smoke test of key NCM functionalities.
- Post-fix check: Check the product version through the web interface (Help -> About) to confirm it is 12.5.658 or later, or 12.6.003 / 12.6.105 / 12.6.120 or later.
- Re-test: Re-run the Nessus scan (plugin ID 62d74383) to confirm the vulnerability is no longer detected.
- Smoke test: Verify that you can log in to NCM and view device status, as well as run a basic report.
# No command available as this requires access to the ManageEngine NCM web interface. Check Help -> About section.6. Preventive Measures and Monitoring
Update security baselines and implement patch management processes to prevent similar vulnerabilities in the future.
- Baselines: Update your security baseline or policy to require the latest ManageEngine NCM patches.
- Asset and patch process: Implement a regular patch review cycle for all critical systems, including ManageEngine NCM.
7. Risks, Side Effects, and Roll Back
Patching may cause temporary service disruption. Ensure you have a database backup to roll back if needed.
- Risk or side effect 1: Patch installation could temporarily interrupt NCM service availability.
- Risk or side effect 2: Compatibility issues with other integrations are possible, though unlikely. Test in a non-production environment first.
- Roll back: Restore the database from the pre-update backup and reinstall the previous version of ManageEngine NCM if necessary.
8. References and Resources
Refer to official vendor advisories for detailed information about this vulnerability.
- Vendor advisory or bulletin: http://www.nessus.org/u?62d74383
- NVD or CVE entry: CVE-2022-37024
- Product or platform documentation relevant to the fix: N/A – Refer to ManageEngine documentation for upgrade instructions.