CyberSecBulletin
CVE-2022-47966Exploited in the wildNVD status: Analyzed

Zoho ManageEngine Multiple Products Remote Code Execution

Published Updated By the CyberSecBulletin desk

CVE-2022-47966 is a critical-severity improper input validation vulnerability in Manageengine Access Manager Plus from Zoho, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 4.3 as the first without the flaw, so updating Manageengine Access Manager Plus to that release or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on January 23, 2023, which means attacks have been observed in the wild, including in ransomware campaigns.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Manageengine Access Manager Plus to 4.3 or a later version.
  2. Update Manageengine Ad360 to 4.3 or a later version.
  3. Update Manageengine Adaudit Plus to 7.0 or a later version.
  4. CISA's required action: Apply updates per vendor instructions.
  5. Read the advisory on cisa.gov for workarounds and exact fixed builds.
  6. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
ZohoManageengine Access Manager Plusbefore 4.3; 4.34.3
ZohoManageengine Ad360before 4.3; 4.34.3
ZohoManageengine Adaudit Plusbefore 7.0; 7.07.0
ZohoManageengine Admanager Plusbefore 7.1; 7.17.1
ZohoManageengine Adselfservice Plusbefore 6.2; 6.26.2
ZohoManageengine Analytics Plusbefore 5.1; 5.15.1
ZohoManageengine Assetexplorerbefore 6.9; 6.96.9
ZohoManageengine Key Manager Plusbefore 6.4; 6.46.4
ZohoManageengine Pam360before 5.7; 5.75.7
ZohoManageengine Password Manager Probefore 12.1; 12.112.1
ZohoManageengine Servicedesk Plusbefore 14.0; 14.014.0
ZohoManageengine Servicedesk Plus Mspbefore 13.0; 13.013.0
ZohoManageengine Supportcenter Plus11.0Not stated
ZohoManageengine Application Control Plusbefore 10.1.2220.1810.1.2220.18
ZohoManageengine Browser Security Plusbefore 11.1.2238.611.1.2238.6
ZohoManageengine Device Control Plusbefore 10.1.2220.1810.1.2220.18
ZohoManageengine Endpoint Dlp Plusbefore 10.1.2137.610.1.2137.6
ZohoManageengine OS Deployerbefore 1.1.2243.11.1.2243.1
ZohoManageengine Patch Manager Plusbefore 10.1.2220.1810.1.2220.18
ZohoManageengine Remote Access Plusbefore 10.1.2228.1110.1.2228.11
ZohoManageengine Remote Monitoring And Management Centralbefore 10.1.4110.1.41
ZohoManageengine Vulnerability Manager Plusbefore 10.1.2220.1810.1.2220.18

Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.19.8CriticalNVD
CVSS 3.19.8CriticalCISA (ADP)

Official description

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

How developers prevent this class of flaw

  • Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build recognizers for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses.
  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.

More Improper Input Validation vulnerabilities (CWE-20)

Timeline

  1. CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
  2. CVE record published.
  3. Added to CISA's Known Exploited Vulnerabilities catalogue.
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other vulnerabilities in Manageengine Access Manager Plus

All Manageengine Access Manager Plus vulnerabilities

Recent Improper Input Validation vulnerabilities

Spotted an error? Tell us.