Authenticated Command Injection in ManageEngine Applications Manager Execute Program Action

This repository provides a proof-of-concept (PoC) exploit for a command execution vulnerability in ManageEngine Applications Manager's 'Execute Program Action' feature. The vulnerability arises from insufficient command validation, allowing attackers to bypass restrictions using absolute paths, environment variables, or script wrappers. The PoC demonstrates how an authenticated attacker can execute arbitrary system commands and exfiltrate data from the target system. The repository contains two files: - README.md: Detailed documentation describing the vulnerability, exploitation methods, example payloads, and usage instructions. - upload_server.py: A standalone Python 3 script that implements a simple HTTP server to receive exfiltrated files. It supports file uploads via POST (to /upload) and PUT (to /upload/[filename]), lists recent uploads, and includes basic security features such as path traversal protection and unique file naming. The main exploit capability is authenticated remote code execution (RCE) on the Applications Manager host, with the ability to exfiltrate files to an attacker-controlled server. The exploit requires network access to the target and valid credentials with permission to use the vulnerable feature. The provided Python server facilitates the exfiltration process by receiving files sent from the compromised host. No detection or scanning functionality is present; this is a pure exploitation PoC.