CVE-2023-2291
📋 TL;DR
This vulnerability involves hardcoded static credentials in PostgreSQL data used by ManageEngine Access Manager Plus, Password Manager Pro, and PAM360. Attackers can exploit these credentials to modify configuration data and escalate privileges from low-privileged users to administrative users. Organizations using affected ManageEngine products are at risk.
💻 Affected Systems
- ManageEngine Access Manager Plus
- ManageEngine Password Manager Pro
- ManageEngine PAM360
📦 What is this software?
Manageengine Access Manager Plus by Zohocorp
⚠️ Risk & Real-World Impact
Worst Case
Full administrative takeover of the ManageEngine system, allowing attackers to access all managed credentials, modify configurations, and potentially pivot to other systems.
Likely Case
Privilege escalation leading to unauthorized access to sensitive credentials and configuration data managed by the affected products.
If Mitigated
Limited impact if proper network segmentation, access controls, and monitoring prevent exploitation attempts.
🎯 Exploit Status
Exploitation requires initial access as a low-privileged user; static credentials make exploitation straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Access Manager Plus build 4310 and later; check vendor advisories for other products
Vendor Advisory: https://www.manageengine.com/products/access-manager-plus/security-updates/cve-2023-2291.html
Restart Required: Yes
Instructions:
1. Backup your current configuration and database. 2. Download and install the latest patch from ManageEngine. 3. Apply the patch following vendor instructions. 4. Restart the ManageEngine service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Database Credential Rotation
allManually change the static PostgreSQL credentials used by the ManageEngine application
ALTER USER manageengine_user WITH PASSWORD 'new_strong_password';
Network Segmentation
allRestrict access to the ManageEngine PostgreSQL database to only necessary application servers
Configure firewall rules to limit database port access (default 5432)
🧯 If You Can't Patch
- Implement strict access controls to limit who can access the ManageEngine applications
- Enable detailed logging and monitoring for privilege escalation attempts and database access
🔍 How to Verify
Check if Vulnerable:
Check your ManageEngine product version against the affected versions listed in the vendor advisoryCheck Version:
Check the product web interface or installation directory for version informationVerify Fix Applied:
Verify the product version has been updated to a patched version and test that low-privileged users cannot escalate to administrative privileges📡 Detection & Monitoring
Log Indicators:
- Unusual database connection attempts
- Privilege escalation events in application logs
- Configuration changes by non-admin users
Network Indicators:
- Unexpected connections to PostgreSQL port from unauthorized sources
- Database query patterns indicating privilege escalation attempts
SIEM Query:
source="manageengine_logs" AND (event_type="privilege_escalation" OR user="low_privilege_user" AND action="admin_action")