CVE-2021-40172
📋 TL;DR
This vulnerability allows attackers to perform Cross-Site Request Forgery (CSRF) attacks against Zoho ManageEngine Log360 proxy settings. Attackers can trick authenticated administrators into changing proxy configurations, potentially redirecting sensitive log data. Organizations using Log360 versions before Build 5219 are affected.
💻 Affected Systems
- Zoho ManageEngine Log360
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers redirect all log traffic through malicious proxy servers, intercepting sensitive security logs, credentials, and system data while maintaining persistence.
Likely Case
Attackers redirect specific log data to collect credentials or sensitive information, potentially leading to further system compromise.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to configuration changes that can be detected and reverted.
🎯 Exploit Status
Requires authenticated administrator interaction but CSRF attacks are well-understood and easily weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Build 5219 or later
Vendor Advisory: https://www.manageengine.com/log-management/readme.html#Build%205219
Restart Required: Yes
Instructions:
1. Download Log360 Build 5219 or later from ManageEngine website. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart the Log360 service.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all proxy configuration forms
Restrict Proxy Configuration Access
allLimit access to proxy settings page to specific admin accounts only
🧯 If You Can't Patch
- Implement network segmentation to isolate Log360 from internet access
- Monitor proxy configuration changes and implement change control procedures
🔍 How to Verify
Check if Vulnerable:
Check Log360 version in web interface under Help > About or via command line: java -jar log360.jar --versionCheck Version:
java -jar log360.jar --versionVerify Fix Applied:
Verify version is Build 5219 or higher and test proxy configuration forms for CSRF tokens📡 Detection & Monitoring
Log Indicators:
- Unexpected proxy configuration changes
- Administrator account accessing proxy settings from unusual IPs
Network Indicators:
- Log traffic redirected to unexpected destinations
- Outbound connections to unknown proxy servers
SIEM Query:
source="Log360" AND (event="Proxy Configuration Change" OR event="Settings Modified")