CVE-2021-20081: 
Zoho ManageEngine ServiceDesk Plus vulnerability analysis and mitigation

CVE-2021-20081 is a vulnerability discovered in ManageEngine ServiceDesk Plus before version 11205. The vulnerability allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges due to incomplete list of disallowed inputs (NVD, Tenable Advisory).

The vulnerability stems from insufficient input sanitization in the custom schedules functionality. While the system attempts to restrict script commands by checking for restricted words, it only considers space-delimited arguments. An attacker can bypass this restriction by using alternative delimiters like commas or semicolons. The vulnerability has a CVSSv3 Base Score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (Tenable Advisory).

When exploited, this vulnerability allows an authenticated attacker to execute arbitrary commands with SYSTEM privileges on the affected system. This means an attacker could potentially gain complete control over the system, access sensitive data, and perform unauthorized administrative actions (NVD).

The vulnerability requires authentication with administrator privileges to exploit. The attack can be executed through the custom schedules page where an attacker can create an action with a maliciously crafted script command. Proof of concept code has been publicly documented (Tenable Advisory).

The recommended mitigation is to upgrade to ManageEngine ServiceDesk Plus version 11205 or later. This version includes patches that address the vulnerability (Tenable Advisory).