CVE-2021-40539
📋 TL;DR
This vulnerability allows attackers to bypass authentication in Zoho ManageEngine ADSelfService Plus REST API, leading to remote code execution. It affects organizations using ADSelfService Plus version 6113 and prior for self-service password management and single sign-on.
💻 Affected Systems
- Zoho ManageEngine ADSelfService Plus
📦 What is this software?
Manageengine Adselfservice Plus by Zohocorp
Manageengine Adselfservice Plus by Zohocorp
Manageengine Adselfservice Plus by Zohocorp
Manageengine Adselfservice Plus by Zohocorp
Manageengine Adselfservice Plus by Zohocorp
Manageengine Adselfservice Plus by Zohocorp
Manageengine Adselfservice Plus by Zohocorp
Manageengine Adselfservice Plus by Zohocorp
Manageengine Adselfservice Plus by Zohocorp
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with domain admin privileges, data exfiltration, ransomware deployment, and lateral movement across the network.
Likely Case
Unauthenticated attackers gain administrative access to ADSelfService Plus, execute arbitrary commands, and potentially compromise Active Directory credentials.
If Mitigated
Attackers are blocked at network perimeter, unable to reach vulnerable systems, with minimal impact due to segmentation and monitoring.
🎯 Exploit Status
Public exploit code available, trivial to execute with automated tools. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 6114 and later
Vendor Advisory: https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
Restart Required: Yes
Instructions:
1. Download latest version from ManageEngine website. 2. Stop ADSelfService Plus service. 3. Install update. 4. Restart service.
🔧 Temporary Workarounds
Network Segmentation
allBlock external access to ADSelfService Plus ports (typically 8888, 8443)
Web Application Firewall Rules
allBlock requests to vulnerable REST API endpoints
🧯 If You Can't Patch
- Immediately isolate affected systems from internet and restrict internal network access
- Implement strict network monitoring for exploitation attempts and unusual REST API activity
🔍 How to Verify
Check if Vulnerable:
Check version number in ADSelfService Plus admin console or installation directory. Versions ≤6113 are vulnerable.Check Version:
Check Help → About in admin interface or examine build.txt in installation directoryVerify Fix Applied:
Confirm version is 6114 or higher and test authentication requirements for REST API endpoints.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated REST API requests to /RestAPI/LogonCustomization
- Unusual process creation from ADSelfService Plus service
Network Indicators:
- HTTP requests to /RestAPI/* endpoints without authentication headers
- Unusual outbound connections from ADSelfService Plus server
SIEM Query:
source="ADSelfService Plus" AND (uri="/RestAPI/*" AND NOT auth_token=*) OR process="cmd.exe" OR process="powershell.exe"🔗 References
- http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
- http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40539
