CVE-2021-38298
📋 TL;DR
This vulnerability allows attackers to perform blind XML External Entity (XXE) attacks against Zoho ManageEngine ADManager Plus. Attackers can exploit this to read arbitrary files from the server, potentially leading to sensitive data exposure. Organizations using ADManager Plus versions before 7110 are affected.
💻 Affected Systems
- Zoho ManageEngine ADManager Plus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the ADManager Plus server, including extraction of sensitive configuration files, credentials, and Active Directory data, potentially enabling lateral movement within the network.
Likely Case
Unauthorized file read access leading to credential theft, configuration exposure, and potential privilege escalation within the ADManager Plus environment.
If Mitigated
Limited impact with proper network segmentation and input validation controls, though some information disclosure may still occur.
🎯 Exploit Status
XXE vulnerabilities are well-understood with readily available exploitation tools. The blind nature requires some additional steps but doesn't significantly increase complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7110
Vendor Advisory: https://www.manageengine.com/products/ad-manager/release-notes.html#7110
Restart Required: Yes
Instructions:
1. Download ADManager Plus version 7110 or later from the ManageEngine website. 2. Stop the ADManager Plus service. 3. Install the update. 4. Restart the service.
🔧 Temporary Workarounds
Disable XML External Entity Processing
allConfigure the XML parser to disable external entity resolution
Modify XML parser configuration to set features: FEATURE_SECURE_PROCESSING = true, http://apache.org/xml/features/disallow-doctype-decl = true
Network Segmentation
allRestrict network access to ADManager Plus instances
Configure firewall rules to limit access to trusted IP addresses only
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all XML input
- Deploy a web application firewall (WAF) with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check the ADManager Plus version in the web interface or installation directory. Versions below 7110 are vulnerable.Check Version:
Check the version in the web interface at /api/json/admin/getproductdetails or examine the build.txt file in the installation directory.Verify Fix Applied:
Verify the version shows 7110 or higher after patching and test XXE payloads to confirm they are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Requests containing XML with DOCTYPE declarations
- Outbound connections to unusual external entities
Network Indicators:
- HTTP requests with XML payloads containing external entity references
- DNS requests for unusual external domains from the ADManager Plus server
SIEM Query:
source="admanager-plus" AND (message="*DOCTYPE*" OR message="*ENTITY*" OR message="*XXE*")