CVE-2019-8394

What is ManageEngine ServiceDesk Plus?

ServiceDesk Plus is Zoho's IT help desk and asset management platform, used by enterprise IT teams to manage support tickets, assets, and change requests. As an internally trusted application often integrated with Active Directory and asset inventories, it is an attractive pivot point for attackers who gain a foothold inside it.

Overview

CVE-2019-8394 is a medium-severity (CVSS 6.5) unrestricted file upload vulnerability (CWE-434) in ServiceDesk Plus's login page customization feature, which allows a low-privileged authenticated user to upload arbitrary files to the server.

Technical Details

The login-page customization function accepts uploaded files (intended to be branding assets like logos) without adequately validating file type or content, allowing a user with low privileges to upload a file — potentially a web shell or script — that could later be accessed or executed by the server, depending on where it is stored relative to the web root.

Discovery

Patched by Zoho as part of routine ServiceDesk Plus maintenance; NVD does not list an individual researcher credit.

Exploitation Context

CISA added this CVE to the KEV catalog in November 2021, confirming it has been used in real-world attacks. ManageEngine products broadly have been a frequent target for both opportunistic and targeted intrusions given their privileged position inside enterprise IT environments and their history of file-upload and deserialization vulnerabilities.

Remediation

1. Update ServiceDesk Plus to the latest patched build from Zoho.
2. Restrict the ability to customize the login page to trusted administrative accounts only.
3. Review upload/attachment directories for unexpected file types (e.g., .jsp, .php, script files).
4. Apply least-privilege principles to ServiceDesk Plus user roles.
5. Monitor web server access logs for requests to unusual upload-derived file paths.