CVE-2021-20078

What it actually does

ManageEngine OpManager builds below 125346 contain an unauthenticated network-accessible path traversal flaw in the Spark gateway component. By supplying traversal sequences in a request handled by that component, an attacker can cause the application to delete arbitrary directories on the underlying operating system. The primary impacts are loss of integrity and availability: application files, configuration directories, uploaded data, logs, or other OS-accessible directories may be removed, causing service failure or broader host instability. The flaw is not described as enabling direct code execution or data disclosure, but arbitrary deletion can destroy evidence and disrupt monitoring operations.

Why it matters to the business

Successful exploitation can take OpManager offline or corrupt its installation and monitoring data, reducing visibility into network, server, and application health at the exact time responders may need it. Because the issue is remotely exploitable without authentication, has public exploit availability, and has a high EPSS probability, internet-exposed or broadly reachable OpManager deployments should be treated as high priority even though it is not currently listed in CISA KEV. Operational consequences may include monitoring outage, missed alerts, incident-response delays, service restoration effort, and potential rebuild from backup.

How an attack unfolds

An attacker first identifies a reachable ManageEngine OpManager instance and determines that it is running a vulnerable build below 125346. The attacker then sends crafted requests to the Spark gateway component containing path traversal sequences that escape the intended directory scope. When processed, the vulnerable component resolves the attacker-controlled path and performs deletion against directories outside the allowed application path. The attacker can target OpManager directories to disable the product, remove logs to hinder investigation, or delete other directories accessible to the OpManager process account. Exploitation is low complexity, remote, unauthenticated, and does not require user interaction.

How to fix it

Upgrade ManageEngine OpManager to build 125346 or later. If an immediate upgrade is not possible, restrict access to OpManager and its Spark gateway component to trusted administrative networks only, block internet access, enforce VPN or bastion access, and apply network-layer rules to reject requests containing traversal patterns. Run the OpManager service with the least-privileged OS account possible so arbitrary deletion is constrained. Maintain recent offline backups of OpManager configuration, databases, and installation directories before patching or performing recovery. After remediation, rotate any credentials that may have been stored in deleted or exposed configuration areas if integrity cannot be assured.

How to confirm the fix worked

Confirm the installed OpManager build is 125346 or later using the product UI, build information files, or vendor-supported version checks. Verify that externally reachable scanners cannot access the OpManager management interface or Spark gateway component unless explicitly intended. Review reverse proxy, WAF, and application logs to ensure path traversal probes are blocked or return safe error responses. Validate file-system permissions by confirming the OpManager service account cannot delete arbitrary directories outside the application’s required paths. Where feasible, test in a non-production environment with a benign traversal payload to confirm the patched build no longer performs unauthorized path resolution or deletion.

Typical attack path

1. Scan for exposed ManageEngine OpManager services on common management ports or known OpManager URLs.
2. Fingerprint the application version or infer vulnerability based on build age and exposed component behavior.
3. Send crafted Spark gateway requests containing path traversal sequences such as parent-directory references.
4. Cause the vulnerable service to resolve the traversal path outside the intended directory.
5. Delete selected directories accessible to the OpManager service account.
6. Trigger service outage, data loss, or removal of application/log directories to impair monitoring and investigation.

How to detect it

Investigate web access logs from OpManager, reverse proxies, load balancers, WAFs, and endpoint telemetry from the OpManager host. Look for requests to OpManager or Spark gateway paths containing traversal sequences, URL-encoded traversal, repeated delete-like requests, unusual 4xx/5xx responses followed by service errors, or abrupt disappearance of application directories. On the host, review file deletion events, endpoint detection logs, filesystem audit logs, service crash logs, and OpManager application logs around the time of suspicious requests. Pay special attention to deletion of OpManager installation, configuration, log, database, backup, or plugin directories. Because exploitation can delete logs, absence of local logs should not be treated as proof of no compromise; corroborate with upstream network and proxy logs.

• ../
• ..%2f
• %2e%2e%2f
• ..%5c
• %2e%2e%5c
• spark
• gateway
• OpManager
• ManageEngine
• path traversal
• java.nio.file.NoSuchFileException
• java.io.FileNotFoundException
• Access is denied
• Permission denied
• No such file or directory
• DELETE
• rm -rf
• rmdir

What your security team should do

• Immediately inventory all ManageEngine OpManager deployments and identify any builds below 125346.
• Prioritize remediation of internet-facing or third-party-accessible instances due to unauthenticated remote exploitability and public exploit availability.
• Upgrade vulnerable instances to build 125346 or later, taking backups before patching.
• Restrict OpManager access to trusted administrative networks and block direct internet exposure.
• Review web, reverse proxy, WAF, and OpManager logs for traversal attempts and suspicious deletion-related activity.
• Check the integrity and presence of OpManager installation, configuration, log, backup, and data directories.
• Restore from known-good backups if arbitrary deletion or corruption is suspected.
• Run OpManager under a least-privileged service account and review OS permissions to limit future blast radius.
• Create SIEM detections for traversal sequences targeting OpManager or Spark gateway paths.