CVE-2021-33256
📋 TL;DR
A CSV injection vulnerability in ManageEngine ADSelfService Plus allows unauthenticated attackers to inject malicious formulas into the login panel. When privileged users export audit reports as CSV files, these formulas can execute arbitrary code, potentially leading to remote command execution. This affects ADSelfService Plus version 6.1 Build 6101.
💻 Affected Systems
- ManageEngine ADSelfService Plus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Privileged user exports CSV report, triggering malicious payload that grants attacker remote shell access with administrative privileges, leading to full system compromise.
Likely Case
Attacker gains initial foothold through command execution, enabling lateral movement, data exfiltration, or ransomware deployment.
If Mitigated
With proper input validation and output encoding, malicious formulas are treated as plain text, preventing code execution.
🎯 Exploit Status
Exploitation requires privileged user interaction (exporting CSV), but initial injection can be performed by unauthenticated users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as vendor disputes vulnerability. Consider upgrading to latest version and implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation to reject or sanitize CSV formula characters in j_username parameter
N/A - Requires code changes
CSV Output Encoding
allEncode CSV output to treat formulas as plain text by prefixing with apostrophe or using proper escaping
N/A - Requires code changes
🧯 If You Can't Patch
- Restrict CSV export functionality to trusted administrators only
- Implement WAF rules to block CSV formula injection patterns in login requests
🔍 How to Verify
Check if Vulnerable:
Test by injecting CSV formula payload into j_username parameter during login and checking if it appears unescaped in exported CSVCheck Version:
Check ADSelfService Plus version in web interface or installation directoryVerify Fix Applied:
Verify that CSV exports properly escape or sanitize formula characters, treating them as plain text📡 Detection & Monitoring
Log Indicators:
- Unusual CSV export activity by privileged users
- Login attempts with formula characters in username field
Network Indicators:
- HTTP requests containing CSV formula patterns (=, +, -, @) in login parameters
SIEM Query:
source="adselfservice" AND (username="=cmd|'" OR username="+cmd|'" OR username="-cmd|'")