Researchers release PoC exploit for ManageEngine RCE (CVE-2022-47966)

by do son · Published · Updated

Horizon3.ai red-teamer James Horseman released a proof-of-concept (PoC) exploit and technical analysis for authentication remote code execution vulnerability in Zoho’s ManageEngine products (CVE-2022-47966) and warns organizations to brace for “spray and pray” attacks across the internet.

Multiple ManageEngine products could allow a remote attacker to execute arbitrary code on the system, caused by the usage of an outdated third-party dependency, Apache Santuario. If SAML single sign-on is currently or has been previously enabled on those products, an attacker could send a SAML request with an invalid signature to execute arbitrary code on the system.

“This vulnerability allows an unauthenticated adversary to execute arbitrary code,” Zoho warned in an advisory.

CVE-2022-47966 affects the following ManageEngine products:

  • Access Manager Plus
  • Active Directory 360
  • ADAudit Plus
  • ADManager Plus
  • ADSelfService Plus
  • Analytics Plus
  • Application Control Plus
  • Asset Explorer
  • Browser Security Plus
  • Device Control Plus
  • Endpoint Central
  • Endpoint Central MSP
  • Endpoint DLP
  • Key Manager Plus
  • OS Deployer
  • PAM 360
  • Password Manager Pro
  • Patch Manager Plus
  • Remote Access Plus
  • Remote Monitoring and Management (RMM)
  • ServiceDesk Plus
  • ServiceDesk Plus MSP
  • SupportCenter Plus
  • Vulnerability Manager Plus

James Horseman released Indicators of Compromise (IOCs) associated with the flaw before and today proof-of-concept (PoC) exploit code is now available for CVE-2022-47966. “Shodan data shows that there are likely more than a thousand instances of ManageEngine products exposed to the internet with SAML currently enabled,” Horseman said.

“The vulnerability allows an attacker to gain remote code execution by issuing a HTTP POST request containing a malicious SAML response,” the researchers wrote.

“This POC abuses the pre-authentication remote code execution vulnerability to run a command with Java’s Runtime.exec method.”

The POC only works on products utilizing Apache Santuario (xmlsec) <= 1.4.1 such as ServiceDesk Plus, Endpoint Central, ADManager Plus, and ADSelfService Plus.

Zoho issued patches late last year and urged customers to patch this critical-severity security flaw.

Tags: CVE-2022-47966CVE-2022-47966 PoC