cbcvebase.
CVE-2021-28958
published 2021-06-25

CVE-2021-28958: Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.

PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
73.13%
99.4th percentile
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.

Affected

13 ranges
VendorProductVersion rangeFixed in
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——
zohocorpmanageengine_adselfservice_plus——

Detection & IOCsextracted from sources · hover to see the quote

url/RestAPI/AuthenticationAPI?operation=domainList↗
url/RestAPI/ChangePasswordAPI↗
url/RestAPI/PasswordSelfServiceAPI?operation=verifyUser&PSS_OPERATION=aaa↗
url/html/_PasswordPolicy.html↗
port8888↗
  • →Detect unauthenticated POST requests to /RestAPI/ChangePasswordAPI containing parameters 'operation=UMCP&umcp=1' — indicative of password-change RCE exploitation attempts against ADSelfService Plus. ↗
  • →Unauthenticated GET to /RestAPI/AuthenticationAPI?operation=domainList can be used for reconnaissance; monitor for this request from external/unauthenticated sources. ↗
  • →A HTTP 200 response to /RestAPI/ChangePasswordAPI with operation=UMCP confirms a valid domain user exists; a 500 response indicates no such user — monitor for enumeration patterns (many 500s followed by a 200). ↗
  • →Monitor unauthenticated access to /html/*_PasswordPolicy.html paths, which can expose domain password policies to any unauthenticated attacker. ↗
  • ·The RCE vulnerability (CVE-2021-28958) is exploitable via the password-change flow and affects ADSelfService Plus through build 6101; build 6111 was the version under further research by Tenable. ↗
  • ·The domain password policy disclosure (CVE-2021-20148) is only exploitable when ADSSP is configured with multiple Windows domains. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.