The Threat

eSentire is aware of a large disclosure of unpatched vulnerabilities in the N-able N-Central Remote Monitoring and Management (RMM) tool. In response to this disclosure, N-able has taken the Hosted N-central environment offline and recommends that on-premises customers "temporarily take their N-central servers offline until further notice from N-able".

A researcher operating under the name Oracle-Security released details on thirty-three vulnerabilities they claim exist in N-Central; Proof-of-Concept (PoC) exploit code was shared for all vulnerabilities. N-able has not directly connected this release to their advisory at the time of writing, and research into the exploits is ongoing. It is alleged that exploits may enable account takeover, data-theft, and disruption. Organizations utilizing On-Premises N-Central servers need to take them offline immediately to prevent exploitation.

What we're doing about it

eSentire's Threat Response Unit (TRU) is performing threat hunts across the customer base
- Impacted customers will be notified by the eSentire SOC
eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as CVE identifiers and fixes become available
TRU is tracking this topic for additional information and detection opportunities

What you should do about it

Organizations running On-Premises N-central servers need to take the relevant servers offline immediately, until hotfixes are released
Apply the vendor security patches when made available

Additional information

N-central is a Remote Monitoring and Management (RMM) platform that is commonly used by Managed Service Providers (MSPs) to monitor, patch, and remotely access endpoints across their customer base. N-able described the release of vulnerabilities as a public disclosure and "non-responsible communication" of critical vulnerabilities found by an independent researcher. N-able has stated that it has not observed exploitation of the flaws at this time and is actively developing a hotfix that will be available to customers "soon". N-Able has not directly stated that GitHub account Oracle-Security is responsible for their decision to take the Hosted N-central environment offline.

If the released PoCs prove to be effective, there is a high probability of immediate exploitation by threat actors, as security patches are not available. This increases the importance of immediate mitigation actions by N-Central users.

Oracle-Security Vulnerability Claim	Description
Anonymous service-import XXE chains NCI session confusion to nable RCE	A feature for importing services could be abused by an anonymous attacker to take over a session and run commands on the N-central server
ProductAdmin GenericTCP stack overflow reaches root MMS command execution	A memory-handling flaw in an administrator-only component could let an attacker run commands with the highest privileges (root)
Zero-role Automation Manager policy disclosure	An account with no assigned roles could view automation policy details it should not see
Pre-auth service-import XXE steals the local NCI session and writes an executable JSP	The same import feature could let an anonymous attacker steal a session and place a file on the server that can later run code
ApplianceRegistration customer/appliance identity confusion	Customer and appliance identities could be confused during registration, letting a user act for another customer or appliance
ServerEI2 registration-token disclosure to Technicians	Registration tokens used to enroll appliances could be exposed to technician users
ServerEI2 userAdd permits unauthorized Technician account creation	A technician could create new user accounts without having the authority to do so
Anonymous asset-discovery database credential disclosure	Asset discovery could disclose database credentials to an anonymous attacker
View-only role injects DeviceExecute configuration	A user with view-only rights could inject changes into device configuration
Anonymous Probe.ListAll cross-customer appliance disclosure	An anonymous attacker could list appliances belonging to other customers
Anonymous SysConfig.Set global configuration overwrite	An anonymous attacker could overwrite global N-central configuration settings
ServerMMS2 session/object mismatch	A mismatch between sessions and objects could let an anonymous session write data belonging to other appliances
Backup restore notification option injection to root	The backup restore feature could be manipulated to run commands as root
Passwordless syslog installer trusts nable-writable configuration	An installer for log forwarding trusts a configuration that the service account can change, allowing escalation to root
Anonymous remote-control session termination	An anonymous attacker could end other users' remote-control sessions
Self-checksummed NSP upload to ProductAdmin root RCE	An update package with a self-supplied integrity check could be uploaded to run commands as root
SIS GenericFiles version traversal to authenticated RCE	A software-distribution feature could be abused through a file path flaw to run code
Anonymous password-reset account enumeration	The password-reset function reveals which user accounts exist
Anonymous remote-control audit-record overwrite	An anonymous attacker could overwrite audit records of remote-control sessions
Anonymous MDM UDID impersonation	An anonymous attacker could impersonate a managed mobile device and steal or forge its commands
Anonymous MMS3 disclosure of reusable Ecosystem Agent credentials	An anonymous attacker could obtain reusable credentials for N-able's agent ecosystem
SIS repository parser authenticated XXE	A parser for software repositories could be abused to read files on the server
Test-email recipient option injection	The test-email feature could be manipulated to write files on the server
Backup restore key-map injection writes executable JSP	The backup restore feature could be manipulated to write an executable file and run code
Custom-service XML import authenticated XXE	Importing a custom service definition could be abused to read server files or make the server contact other systems
Anonymous MMS3 patch XSS to Audit Export root RCE	Malicious content injected anonymously into patch information could lead to root code execution when an administrator views it and uses the audit export
Audit Export serverIp syslog-ng grammar injection	A setting in the audit export feature could be manipulated to run commands as root
Anonymous MMS3 patch XSS to OGNL nable RCE	The same anonymous injection into patch information could lead to code execution as the service account when an administrator views it
File Repository upload filename traversal to RCE	A file upload feature could be abused through crafted file names to run code
ServerEI2 repository publish arbitrary file write	A repository publishing feature could be abused to write arbitrary files to the server (write only, no code execution claimed)
Predictable ServerMMS3 passcode	A predictable passcode could let an attacker authenticate to a server component
Pre-upgrade helper executes nable-controlled script as root	A helper that runs before upgrades executes a script that the service account can modify, allowing escalation to root
Authenticated OGNL expression injection to nable RCE	Any logged-in user could run code on the server through a flaw in how user input is handled

References

[1] https://uptime.n-able.com/event/202561/
[2] https://github.com/Oracle-Security/CVEs/tree/main/0-Days/N-Central%20N-Able#vulnerabilities

Back to Security Advisories

Speak With A Security Expert Now

TALK TO AN EXPERT

Security advisories

N-able N-Central Vulnerabilities Publicly Disclosed