Zoho ManageEngine ServiceDesk Plus Login Page Customization Arbitrary File Upload Vulnerability (CVE-2019-8394)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2019-8394) is an arbitrary file upload flaw (CWE-434) residing in the login page customization component of Zoho ManageEngine ServiceDesk Plus (SDP). The root cause is the lack of proper validation on file extensions and MIME types when users customize the login portal's appearance. This allows an authenticated attacker to bypass intended restrictions and upload malicious executable scripts instead of standard image files.

2. Exploitation Mechanics & Attack Scenario

An attacker with valid credentials (even with low privileges) accesses the login page customization interface. By crafting a multipart/form-data POST request, the attacker uploads a malicious payload (e.g., a JSP web shell) disguised or named with a '.jsp' extension. Because the application fails to sanitize the file type and stores it directly within the web-accessible directory, the attacker can trigger the payload by sending a direct HTTP request to the uploaded file's URL, achieving arbitrary code execution under the context of the application server.

3. Infrastructure & Business Impact

As this vulnerability is listed in the CISA KEV catalog, it has been actively exploited in the wild. Successful exploitation grants the attacker system-level privileges on the host operating system. This can lead to full domain compromise, lateral movement within the corporate network, data exfiltration, and deployment of ransomware, posing a severe threat to business continuity.