CVE-2021-20130

published 2021-10-13

CVE-2021-20130: ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the…

Priority P2 68 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswordExpiry interface.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zohocorp	manageengine_admanager_plus	< 7.1	7.1
zohocorp	manageengine_admanager_plus	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /RestAPI/WC/PasswordExpiryNotification↗

path \webapps\adsm\ompemberapp\PasswordExpiryNotification\↗

url /ompemberapp/PasswordExpiryNotification/<timestamp>_<filename>↗

filename 1630429499081_webshell.jsp↗

• → Monitor for HTTP POST requests to /RestAPI/WC/PasswordExpiryNotification containing multipart file upload data, especially with .jsp file extensions, from authenticated sessions. ↗
• → Alert on HTTP GET requests to /ompemberapp/PasswordExpiryNotification/ for files matching the pattern <epoch_milliseconds>_<filename>.jsp, which indicates webshell execution attempts. ↗
• → Detect new .jsp files written to the \webapps\adsm\ompemberapp\PasswordExpiryNotification\ directory on the ADMP host as a file integrity monitoring rule. ↗
• → Monitor for debugger attachment to the ADMP Java process and breakpoints set on ADsOpenObject in ACTIVEDS.dll, which may indicate credential harvesting post-exploitation. ↗
• → Alert on unexpected creation of new local Windows administrative accounts on the ADMP host, which is a known post-exploitation action following successful JSP webshell execution. ↗

• · The vulnerability is post-authentication only; exploitation requires valid credentials to the ManageEngine ADManager Plus web interface (Build 7111). ↗
• · Uploaded JSP webshell filenames are deterministic: they follow the pattern <epoch_milliseconds>_<attacker_supplied_filename>.jsp, where the timestamp is the file creation time in milliseconds since the Unix Epoch. ↗
• · Domain accounts configured in ADMP for Active Directory operations are high-value targets post-exploitation, as they typically hold domain administrator privileges. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434