CVE-2023-29084
published 2023-04-13CVE-2023-29084: Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
PriorityP269high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EXPLOIT
EPSS
98.39%
99.9th percentile
Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zohocorp | manageengine_admanager_plus | < 7.1 | 7.1 |
| zohocorp | manageengine_admanager_plus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/j_security_check
commandnslookup.exe {{interactsh-url}} 1.1.1.1
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zoho ManageEngine RecoveryManager Plus updateProxySettings Command Injection (CVE-2023-48646)"; flow:established,to_server; http.uri; content:"/api/json/admin/saveServerSettings"; fast_pattern; http.request_body; content:"admpcsrf|3d|"; content:"|22|PASSWORD|22 3a|"; pcre:"/^\s*\x22[^\x22]*?(?:\x5cr|\x5cn|[\x3b\x26\x60\x7c\x24])/R"; reference:url,hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/; reference:cve,2023-48646; classtype:web-application-attack; sid:2066204; rev:1; metadata:affected_product Zoho_ManageEngine, attack_target Server, tls_state TLSDecrypt, created_at 2025_12_09, cve CVE_2023_48646, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2025_12_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
- →Exploit POST request targets /api/json/admin/saveServerSettings with a JSON params array containing a PASSWORD or USERNAME field with an embedded CRLF (\r\n) followed by the injected OS command, used to abuse proxy settings.
- →Exploit flow requires prior authentication via POST to /j_security_check with is_admp_pass_encrypted=false, followed by a GET to /home.do to extract the admpcsrf CSRF token from response headers before sending the injection payload.
- →Successful exploitation response body contains both '{"message":"' and 'Proxy Settings', which can be used as a detection matcher for the exploit's HTTP response.
- →The Snort/ET rule detects the attack by matching the URI /api/json/admin/saveServerSettings, the POST body containing admpcsrf= and a PASSWORD field whose value starts with a quoted string containing CR, LF, or shell metacharacters (;, &, `, |, $).
- →The injection is delivered via the ChangePasswordAction function; the CRLF sequence in USERNAME or PASSWORD breaks out of the proxy settings string and causes the trailing content to be executed as an OS command by the server process (typically running as local administrator on Windows). ↗
- →DNS callback (OOB) via nslookup.exe is used to confirm blind RCE; monitor for unexpected DNS lookups originating from ADManager Plus server processes.
- →The X-Requested-With: XMLHttpRequest header is present in the exploit's injection request; its absence or presence alongside the malicious POST body can aid in distinguishing exploit traffic.
- ·Exploitation requires prior valid authentication to ADManager Plus; unauthenticated attackers cannot reach the vulnerable endpoint /api/json/admin/saveServerSettings. ↗
- ·The exploit modifies the HTTP proxy settings for the entire ADManager Plus server as a side effect; fetch/HTTP-based payloads will be disrupted by the changed proxy configuration. ↗
- ·The ET Snort rule (sid:2066204) is formally attributed to CVE-2023-48646 (RecoveryManager Plus) but references the CVE-2023-29084 ADManager Plus research blog; verify applicability before deploying against ADManager Plus traffic.
- ·The ET rule requires TLS decryption to be effective, as indicated by the tls_state and deployment metadata.
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SPECIFIC_APPS Zoho ManageEngine RecoveryManager Plus updateProxySettings Command Injection (CVE-2023-48646)
suricata·2025-12-09·CVSS 7.2
CVE-2023-48646 [HIGH] ET WEB_SPECIFIC_APPS Zoho ManageEngine RecoveryManager Plus updateProxySettings Command Injection (CVE-2023-48646)
ET WEB_SPECIFIC_APPS Zoho ManageEngine RecoveryManager Plus updateProxySettings Command Injection (CVE-2023-48646)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zoho ManageEngine RecoveryManager Plus updateProxySettings Command Injection (CVE-2023-48646)"; flow:established,to_server; http.uri; content:"/api/json/admin/saveServerSettings"; fast_pattern; http.request_body; content:"admpcsrf|3d|"; content:"|22|PASSWORD|22 3a|"; pcre:"/^\s*\x22[^\x22]*?(?:\x5cr|\x5cn|[\x3b\x26\x60\x7c\x24])/R"; reference:url,hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/; reference:cve,2023-48646; classtype:web-application-attack; sid:2066204; rev:1; metadata:affected_product Zoho_ManageEngine, attack_target Server, tls_state TLSDecrypt, created
Nuclei
ManageEngine ADManager Plus - Command Injection
nuclei·CVSS 7.2
CVE-2023-29084 [HIGH] ManageEngine ADManager Plus - Command Injection
ManageEngine ADManager Plus - Command Injection
Zoho ManageEngine ADManager Plus through 7180 allows for authenticated users to exploit command injection via Proxy settings.
Template:
id: CVE-2023-29084
info:
name: ManageEngine ADManager Plus - Command Injection
author: rootxharsh,iamnoooob,pdresearch
severity: high
description: |
Zoho ManageEngine ADManager Plus through 7180 allows for authenticated users to exploit command injection via Proxy settings.
impact: |
Successful exploitation of this vulnerability could lead to remote code execution, unauthorized access to sensitive information, or complete compromise of the target system.
remediation: |
Apply the latest security patch or update provided by the vendor to fix the command injection vulnerability in ManageEngine ADManager Plus
Metasploit
ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection
metasploit
ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection
ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection
ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient validation of user input when performing the ChangePasswordAction function before passing it into a string that is later used as an OS command to execute. By making a POST request to /api/json/admin/saveServerSettings with a params POST parameter containing a JSON array object that has a USERNAME or PASSWORD element containing a carriage return and newline, followed by the command the attacker wishes to execute, an attacker can gain RCE as the user running ADManager Plus, which will typically be the local administrator. Note that the attacker must be authenticated in order to send requests t
No writeups or analysis indexed.
http://packetstormsecurity.com/files/172755/ManageEngine-ADManager-Plus-Command-Injection.htmlhttps://manageengine.comhttps://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.htmlhttp://packetstormsecurity.com/files/172755/ManageEngine-ADManager-Plus-Command-Injection.htmlhttps://manageengine.comhttps://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html
2023-04-13
Published