CVE-2021-37921
📋 TL;DR
CVE-2021-37921 is a critical vulnerability in Zoho ManageEngine ADManager Plus that allows attackers to upload arbitrary files without restrictions, leading to remote code execution. This affects all organizations using ADManager Plus version 7110 and earlier for Active Directory management. Attackers can gain complete control of affected systems.
💻 Affected Systems
- Zoho ManageEngine ADManager Plus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary code, steal credentials, pivot to other systems, and deploy ransomware or other malware across the network.
Likely Case
Remote code execution leading to data exfiltration, installation of backdoors, and lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation, file upload restrictions, and monitoring are in place, though the vulnerability remains exploitable.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. Attackers can exploit without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 7111 and later
Vendor Advisory: https://www.manageengine.com/products/ad-manager/release-notes.html#7111
Restart Required: Yes
Instructions:
1. Download ADManager Plus version 7111 or later from ManageEngine website. 2. Backup current installation. 3. Stop ADManager Plus service. 4. Install the new version. 5. Restart the service.
🔧 Temporary Workarounds
Restrict File Uploads
allImplement strict file upload validation and restrictions at the web application firewall or application level.
Network Segmentation
allIsolate ADManager Plus instances from critical network segments and restrict inbound access.
🧯 If You Can't Patch
- Immediately remove internet-facing access and restrict to internal network only with strict firewall rules.
- Implement application-level file upload validation and monitoring for suspicious file upload attempts.
🔍 How to Verify
Check if Vulnerable:
Check ADManager Plus version in web interface or installation directory. Versions 7110 and earlier are vulnerable.Check Version:
Check web interface or look for version.txt in installation directory.Verify Fix Applied:
Verify version is 7111 or later and test file upload functionality with malicious files to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload attempts
- Execution of unexpected processes
- Web server error logs showing file upload validation failures
Network Indicators:
- HTTP POST requests with file uploads to ADManager Plus endpoints
- Outbound connections from ADManager Plus server to unknown IPs
SIEM Query:
source="admanager-plus" AND (event="file_upload" OR event="process_execution")