CVE-2022-28219: Proof-of-Concept Published for Unauthenticated RCE in Zoho ManageEngine ADAudit Plus
New information and technical details, including a proof-of-concept have been published for a remote code execution flaw in Zoho ManageEngine ADAudit Plus that was patched last month.
Background
On June 29, researchers at Horizon3.ai published a blog post about a recently disclosed vulnerability in Zoho ManageEngine ADAudit Plus, a compliance tool that monitors Active Directory (AD).
| Product | Vulnerability Description | CVSSv3 Score | VPR* |
|---|---|---|---|
| Zoho ManageEngine AUAudit Plus version 7060 or lower | Unauthenticated remote code execution | 9.8 | 9.0 |
*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on June 30 and reflects VPR at that time.
The vulnerability, CVE-2022-28219, was patched on March 30. Approximately three months later, the researchers who discovered it have shared a proof-of-concept (PoC) script that automates the steps to pivot from a XML external entity (XXE) flaw to remote code execution (RCE).
Analysis
CVE-2022-28219 is an unauthenticated RCE caused by underlying Java deserialization, blind XXE injection and path traversal vulnerabilities. This chain of flaws could be exploited to not only achieve RCE, but also compromise domain administrator accounts. This effect of the flaw will make it very attractive to ransomware groups and initial access brokers.
Previousvulnerabilities in Zoho products have been leveraged by advanced persistent threat actors against a variety of targets including academic institutions, defense contractors and critical infrastructure. In late 2021, three vulnerabilities in separate Zoho ManageEngine products were being actively exploited by threat actors. Based on this history, organizations should prioritize patching CVE-2022-28219 immediately.
Solution
This vulnerability impacts all versions of ADAudit Plus builds below 7060. Organizations should ensure they are running the fixed or later version of ADAudit Plus.
Identifying affected systems
A list of Tenable plugins covering CVE-2022-28219 can be found here. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released.
Get more information
- Zoho ManageEngine ADAudit Plus advisory for CVE-2022-28219
- Horizon3.ai technical write up
- Identifying XML External Entity: How Tenable.io Web Application Scanning Can Help
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 30-day trial of Tenable.io Vulnerability Management.
Related Articles
Cybersecurity Snapshot: CISA Shines Light on Cloud Security and on Hybrid IAM Systems’ Integration
March 15, 2024Check out CISA’s latest best practices for protecting cloud environments, and for securely integrating on-prem and cloud IAM systems. Plus, catch up on the ongoing Midnight Blizzard attack against Microsoft. And don’t miss the latest CIS Benchmarks. And much more!
Poor Identity Hygiene at Root of Nation-State Attack Against Microsoft
February 1, 2024The latest breach suffered by Microsoft shows once again that detection and response are not enough. Because the source of an attack almost always boils down to a single overlooked user and permission, it’s critical for organizations to have strong preventive security.
Cybersecurity Snapshot: What’s in Store for 2024 in Cyberland? Check Out Tenable Experts’ Predictions for OT Security, AI, Cloud Security, IAM and more
December 29, 2023The new year is upon us, and so we ponder the question: What cybersecurity trends will shape 2024? To find out, we asked Tenable experts to read the tea leaves. Their 2024 forecasts include: A bigger security role for cloud architects; a focus by ransomware gangs on OT systems in critical industries; an intensification of IAM attacks; and much more!
Securing Financial Data in the Cloud: How Tenable Can Help
November 4, 2024Preventing data loss, complying with regulations, automating workflows and managing access are four key challenges facing financial institutions. Learn how Tenable can help.
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
- Active Directory
- Vulnerability Management