ZohoCorp ManageEngine Endpoint Central versions earlier than 11.4.2508.14, 11.4.2516.06, and 11.4.2518.01 are affected by an arbitrary file deletion vulnerability in the agent setup component.
ManageEngine Endpoint Central 11.4.2516.06 之前的11.4.2516.x版本
ManageEngine Endpoint Central 11.4.2518.01 之前的11.4.2518.x版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-5496 - ManageEngine Endpoint Central Arbitrary File Deletion PoC
# This is a conceptual PoC demonstrating the exploitation path.
# Actual exploitation requires access to the Endpoint Central Agent Setup component.
import os
import sys
def exploit_arbitrary_file_deletion(target_file_path):
"""
Exploit arbitrary file deletion vulnerability in ManageEngine Endpoint Central
Agent Setup component via path traversal.
The vulnerability exists because the agent setup process does not properly
sanitize file paths, allowing a low-privileged user to delete arbitrary files.
"""
# Step 1: Identify the vulnerable agent setup process/handler
# The Endpoint Central agent installer runs with elevated privileges on the endpoint
# Step 2: Craft a malicious path using path traversal sequences
# The agent setup component accepts file paths from low-privileged users
# without proper validation
malicious_path = target_file_path
# Step 3: Trigger the deletion through the vulnerable component
# This could be done via:
# - Inter-process communication with the agent setup service
# - Manipulating agent uninstall/upgrade parameters
# - Exploiting symlink attacks during agent operations
print(f"[*] Targeting file: {malicious_path}")
print(f"[*] Attempting arbitrary file deletion via agent setup component...")
# The actual exploitation would interact with the Endpoint Central
# agent setup API or service to trigger the file deletion
# with the crafted path
return f"File deletion attempted on: {malicious_path}"
if __name__ == "__main__":
if len(sys.argv) > 1:
target = sys.argv[1]
else:
target = "C:\\Windows\\System32\\drivers\\etc\\sample_target_file"
result = exploit_arbitrary_file_deletion(target)
print(f"[+] {result}")