CVE-2021-20136: 
Zoho ManageEngine Log360 vulnerability analysis and mitigation

ManageEngine Log360 builds prior to 5235 were affected by an improper access control vulnerability (CVE-2021-20136) that allowed database configuration overwrite. The vulnerability was discovered in October 2021 and fixed by ManageEngine on October 15, 2021. This critical security flaw affected the Log360 product, which is a comprehensive log management and Active Directory auditing solution (Tenable Advisory).

The vulnerability has a CVSSv3 Base Score of 9.8 (Critical) with the vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw allows an unauthenticated remote attacker to send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and force Log360 to restart. The vulnerability exists in the database configuration functionality, specifically affecting the configuration stored in \conf\database_params.conf (Tenable Advisory).

The vulnerability's exploitation can lead to several severe consequences including denial of service where legitimate users may no longer be able to login to Log360, authentication bypass as login credentials for the 'Log360 Authentication' domain would be stored in the attacker-controlled database, and REST API restriction bypass where the attacker can add more REST APIs to the adsproductapis table, potentially exposing additional attack vectors (Tenable Advisory).

The vulnerability can be exploited by an unauthenticated remote attacker by sending a specially crafted message to change the Log360 database configurations. A proof of concept exists demonstrating how an attacker can modify the database parameters and force a restart of the application using a simple curl command (Tenable Advisory).

ManageEngine has addressed this vulnerability by releasing a fix in Log360 version 5235. Users are strongly advised to upgrade to this version or later to protect against potential exploitation (ManageEngine Readme, Tenable Advisory).