Zoho ManageEngine Access Manager Plus Apache xmlsec Remote Code Execution

Summaryinfo

A vulnerability has been found in Zoho ManageEngine Access Manager Plus, Active Directory 360, ADAudit Plus, ADManager Plus, ADSelfService Plus, Analytics Plus, Application Control Plus, Asset Explorer, Browser Security Plus, Device Control Plus, Endpoint Central, Endpoint Central MSP, Endpoint DLP, Key Manager Plus, OS Deployer, PAM 360, Password Manager Pro, Patch Manager Plus, Remote Access Plus, Remote Monitoring and Management, ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus and Vulnerability Manager Plus and classified as problematic. This affects an unknown part of the component Apache xmlsec. This manipulation causes an unknown weakness. This vulnerability is registered as CVE-2022-47966. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in Zoho ManageEngine Access Manager Plus, Active Directory 360, ADAudit Plus, ADManager Plus, ADSelfService Plus, Analytics Plus, Application Control Plus, Asset Explorer, Browser Security Plus, Device Control Plus, Endpoint Central, Endpoint Central MSP, Endpoint DLP, Key Manager Plus, OS Deployer, PAM 360, Password Manager Pro, Patch Manager Plus, Remote Access Plus, Remote Monitoring and Management, ServiceDesk Plus, ServiceDesk Plus MSP, SupportCenter Plus and Vulnerability Manager Plus (Access Management Software). Affected by this vulnerability is an unknown part of the component Apache xmlsec. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

The weakness was published 01/18/2023. It is possible to read the advisory at manageengine.com. This vulnerability is known as CVE-2022-47966 since 12/26/2022. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available.

A public exploit has been developed in Python and been published 1 days after the advisory. It is possible to download the exploit at github.com. It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 01/23/2023 with a due date of 02/13/2023:

Apply updates per vendor instructions.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at manageengine.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Access Management Software

Vendor

• Zoho ManageEngine

Name

• Access Manager Plus
• Active Directory 360
• ADAudit Plus
• ADManager Plus
• ADSelfService Plus
• Analytics Plus
• Application Control Plus
• Asset Explorer
• Browser Security Plus
• Device Control Plus
• Endpoint Central
• Endpoint Central MSP
• Endpoint DLP
• Key Manager Plus
• OS Deployer
• PAM 360
• Password Manager Pro
• Patch Manager Plus
• Remote Access Plus
• Remote Monitoring and Management
• ServiceDesk Plus
• ServiceDesk Plus MSP
• SupportCenter Plus
• Vulnerability Manager Plus

License

• commercial

Website

• Vendor: https://www.manageengine.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion