Description
Zoho ManageEngine Desktop Central 10.0.474之前的版本允许远程代码执行，因为FileStorage类中getChartImage中不受信任的数据被反序列化。这与CewolfServlet和MDMLogUploaderServlet servlet相关。
Zoho ManageEngine 反序列化远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2020-10189
https://www.anquanke.com/post/id/200474
https://y4er.com/posts/cve-2020-10189-zoho-manageengine-rce/
https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html
https://www.sentinelone.com/vulnerability-database/cve-2020-10189/
https://srcincite.io/advisories/src-2020-0011/
https://www.exploit-db.com/exploits/48224
https://blog.reconinfosec.com/analysis-of-exploitation-cve-2020-10189
https://securityaffairs.com/132797/hacking/zoho-manageengine-adaudit-plus-rce.html
https://horizon3.ai/attack-research/disclosures/red-team-blog-cve-2022-28219/