CVE-2021-37931
📋 TL;DR
This vulnerability allows attackers to upload arbitrary files to Zoho ManageEngine ADManager Plus servers, which can lead to remote code execution. It affects ADManager Plus version 7110 and earlier. Attackers can potentially gain full control of affected systems.
💻 Affected Systems
- Zoho ManageEngine ADManager Plus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative privileges, data exfiltration, lateral movement within the network, and persistent backdoor installation.
Likely Case
Remote code execution leading to web shell deployment, credential theft, and further network reconnaissance.
If Mitigated
Limited impact with proper network segmentation, file upload restrictions, and monitoring in place.
🎯 Exploit Status
Exploitation requires no authentication and has been observed in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7111
Vendor Advisory: https://www.manageengine.com/products/ad-manager/release-notes.html#7111
Restart Required: Yes
Instructions:
1. Download ADManager Plus version 7111 or later from ManageEngine website. 2. Backup current installation. 3. Run the installer to upgrade. 4. Restart the ADManager Plus service.
🔧 Temporary Workarounds
Restrict File Uploads
allConfigure web server to block file uploads to vulnerable endpoints
Network Segmentation
allIsolate ADManager Plus server from internet and restrict internal access
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy web application firewall with file upload restrictions
🔍 How to Verify
Check if Vulnerable:
Check ADManager Plus version in web interface or installation directoryCheck Version:
Check Help > About in web interface or examine buildinfo.txt in installation directoryVerify Fix Applied:
Confirm version is 7111 or later and test file upload functionality📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to ADManager Plus endpoints
- Web shell creation in web directories
- Suspicious process execution from web server context
Network Indicators:
- HTTP POST requests to file upload endpoints with executable content
- Outbound connections from ADManager Plus server to unknown IPs
SIEM Query:
source="ADManagerPlus" AND (url="*upload*" OR url="*file*" OR process="cmd.exe" OR process="powershell.exe")