How to remediate – ManageEngine Security Manager Plus Default Administrator Crede…

1. Introduction

The vulnerability, ManageEngine Security Manager Plus Default Administrator Credentials, involves a web application using default administrative credentials (‘admin’ / ‘admin’). This allows attackers to gain unauthorized access to the management interface of affected systems, potentially compromising confidentiality, integrity, and availability. Systems running unconfigured instances of ManageEngine Security Manager Plus are typically affected.

2. Technical Explanation

The remote ManageEngine Security Manager Plus installation uses a default set of credentials (‘admin’ / ‘admin’) to control access to its management interface. An attacker can exploit this by attempting to log in with these default credentials. This is due to an unsafe default configuration, allowing unauthorized administrative access.

• Root cause: Use of default administrator credentials.
• Exploit mechanism: An attacker attempts to login using the ‘admin’ / ‘admin’ username and password combination.
• Scope: ManageEngine Security Manager Plus installations with unchanged default credentials.

3. Detection and Assessment

To confirm vulnerability, check if the application is accessible via a web browser and whether it accepts the default ‘admin’ / ‘admin’ credentials. A thorough method involves attempting to log in using these credentials from an external system.

• Quick checks: Access the ManageEngine Security Manager Plus login page in a web browser.
• Scanning: Nessus plugin ID 139648 can detect this vulnerability. This is provided as an example only.
• Logs and evidence: Check application logs for successful logins with the ‘admin’ user account.

4. Solution / Remediation Steps

To fix this issue, log into the application and change the default login credentials to a strong, unique password.

4.1 Preparation

• Dependencies: Access to the ManageEngine Security Manager Plus web interface is required. Roll back plan: Restore from backup if necessary.
• Change window needs and approval may be needed depending on organizational policy.

4.2 Implementation

1. Step 1: Log into the ManageEngine Security Manager Plus application using the default credentials (‘admin’ / ‘admin’).
2. Step 2: Navigate to Admin > Users > Change Password.
3. Step 3: Enter the current password (‘admin’).
4. Step 4: Enter a new, strong password and confirm it.
5. Step 5: Save the changes.

4.3 Config or Code Example

Before

Username: admin
Password: admin

After

Username: [New Username]
Password: [New Strong Password]

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability type include safe defaults and least privilege. Using strong passwords reduces the risk of unauthorized access if default credentials are compromised. Least privilege limits the impact of a successful exploit.

• Practice 1: Implement strong password policies to enforce complex and unique passwords.
• Practice 2: Regularly review user accounts and permissions, removing unnecessary privileges.

4.5 Automation (Optional)

No suitable automation script is available for this vulnerability due to the need for interactive login and password change.

5. Verification / Validation

• Post-fix check: Attempt to log in using ‘admin’ / ‘admin’. Expected output: Login failed.
• Re-test: Repeat step 1 from section 3, which should now fail.
• Smoke test: Verify access to the application dashboard and key reports.

6. Preventive Measures and Monitoring

Update security baselines to include a check for default credentials on ManageEngine Security Manager Plus installations. Implement regular patch cycles to address known vulnerabilities.

• Baselines: Update security configuration baselines to require changing default passwords during initial setup.
• Asset and patch process: Implement a regular patch review cycle for all software, including ManageEngine Security Manager Plus.

7. Risks, Side Effects, and Roll Back

Changing the password incorrectly could lock out administrative access. Ensure you have documented the new password securely. If locked out, restore from backup or contact support.

• Roll back: Restore the application from a recent backup.

8. References and Resources

Links only to sources that match this exact vulnerability. Use official advisories and trusted documentation. Do not include generic links.

• Vendor advisory or bulletin: https://www.manageengine.com/secure-browser/