New information and technical details, including a proof-of-concept have been published for a remote code execution flaw in Zoho ManageEngine ADAudit Plus that was patched last month.
Background
On June 29, researchers at Horizon3.ai published a blog post about a recently disclosed vulnerability in Zoho ManageEngine ADAudit Plus, a compliance tool that monitors Active Directory (AD).
| Product | Vulnerability Description | CVSSv3 Score | VPR* |
|---|---|---|---|
| Zoho ManageEngine AUAudit Plus version 7060 or lower | Unauthenticated remote code execution | 9.8 | 9.0 |
*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on June 30 and reflects VPR at that time.
The vulnerability, CVE-2022-28219, was patched on March 30. Approximately three months later, the researchers who discovered it have shared a proof-of-concept (PoC) script that automates the steps to pivot from a XML external entity (XXE) flaw to remote code execution (RCE).
Analysis
CVE-2022-28219 is an unauthenticated RCE caused by underlying Java deserialization, blind XXE injection and path traversal vulnerabilities. This chain of flaws could be exploited to not only achieve RCE, but also compromise domain administrator accounts. This effect of the flaw will make it very attractive to ransomware groups and initial access brokers.
Previousvulnerabilities in Zoho products have been leveraged by advanced persistent threat actors against a variety of targets including academic institutions, defense contractors and critical infrastructure. In late 2021, three vulnerabilities in separate Zoho ManageEngine products were being actively exploited by threat actors. Based on this history, organizations should prioritize patching CVE-2022-28219 immediately.
Solution
This vulnerability impacts all versions of ADAudit Plus builds below 7060. Organizations should ensure they are running the fixed or later version of ADAudit Plus.
Identifying affected systems
A list of Tenable plugins covering CVE-2022-28219 can be found here. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released.
Get more information
- Zoho ManageEngine ADAudit Plus advisory for CVE-2022-28219
- Horizon3.ai technical write up
- Identifying XML External Entity: How Tenable.io Web Application Scanning Can Help
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.