Description

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-28T12:17:36.597Z",
  "pubdate": "2026-09-28T12:17:36.597Z",
  "executiveSummary": "ManageEngine DDI Central versions prior to 6201 are susceptible to an arbitrary file write vulnerability within the High Availability (HA) Failover configuration synchronization mechanism.\nThis vulnerability allows an unauthenticated or authenticated attacker with sufficient network access to inject malicious files into the application directory.\nSuccessful exploitation facilitates Remote Code Execution (RCE) by overwriting critical application components, granting the attacker the ability to execute arbitrary commands with the privileges of the service user.\nThe flaw represents a critical security risk, as it enables full system compromise, unauthorized data access, and potential lateral movement within the enterprise network.\nMitigation requires immediate patching to version 6201 or later to address the insecure handling of file uploads during the synchronization process.",
  "technicalDetails": "The vulnerability resides within the High Availability (HA) failover configuration synchronization module of ManageEngine DDI Central. The flaw is triggered due to improper validation and sanitization of file uploads during the configuration synchronization phase between HA nodes.\nAttack flow: An attacker initiates a malicious HA failover configuration synchronization request. The system, failing to adequately validate the path or contents of the incoming configuration package, allows the writing of files to unauthorized locations within the application filesystem. By crafting a specific payload within the synchronization data, an attacker can overwrite existing application files or upload arbitrary executable scripts into directories accessible by the web server or application runtime.\nRoot cause: The vulnerability stems from a path traversal or insecure file handling logic within the synchronization service that processes configuration data. Because the system assumes that synchronization data originates from a trusted peer node, it lacks the necessary security constraints to prevent an attacker from manipulating the destination path of the file write operation.\nExploitation method: By sending a specially crafted request targeting the HA sync endpoint, an attacker forces the application to write a malicious payload to a known executable path or a configuration file that dictates application behavior. Once the file is written, the attacker triggers its execution—either by navigating to the newly uploaded file path or by causing the application to reload the tampered configuration.\nPost-exploitation: Once the malicious code executes, the attacker gains full control over the application environment. This includes the ability to perform reconnaissance, exfiltrate sensitive network infrastructure data stored within DDI Central, modify DNS and IPAM records, and establish persistence on the host server. The impact is essentially total system compromise, as the service typically operates with elevated system or root-level privileges."
}