BreachExchange mailing list archives
CISA Warns of Actively Exploited Zoho ManageEngine ADSelfService Vulnerability
From: Sophia Kingsbury <sophia.kingsbury () riskbasedsecurity com>
Date: Thu, 9 Sep 2021 08:27:42 -0400
https://thehackernews.com/2021/09/cisa-warns-of-actively-exploited-zoho.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday issued a bulletin warning of a zero-day flaw affecting Zoho ManageEngine ADSelfService Plus deployments that is currently being actively exploited in the wild. The flaw, tracked as CVE-2021-40539, concerns a REST API authentication bypass that could lead to arbitrary remote code execution (RCE). ADSelfService Plus builds up to 6113 are impacted. ManageEngine ADSelfService Plus is an integrated self-service password management and a single sign-on solution for Active Directory and cloud apps, enabling admins to enforce two-factor authentication for application logins and users to reset their passwords. "CVE-2021-40539 has been detected in exploits in the wild. A remote attacker could exploit this vulnerability to take control of an affected system," CISA said, urging companies to apply the latest security update to their ManageEngine servers and "ensure ADSelfService Plus is not directly accessible from the internet." In an independent advisory, Zoho cautioned that it's a "critical issue" and that it's "noticing indications of this vulnerability being exploited." "This vulnerability allows an attacker to gain unauthorized access to the product through REST API endpoints by sending a specially crafted request," the company said. "This would allow the attacker to carry out subsequent attacks resulting in RCE." CVE-2021-40539 is the fifth security weakness disclosed in ManageEngine ADSelfService Plus since the start of the year, three of which — CVE-2021-37421 (CVSS score: 9.8), CVE-2021-37417 (CVSS score: 9.8), and CVE-2021-33055 (CVSS score: 9.8) — were addressed in recent updates. A fourth vulnerability, CVE-2021-28958 (CVSS score: 9.8), was rectified in March 2021. This development also marks the second time a flaw in Zoho enterprise products has been actively exploited in real-world attacks. In March 2020, APT41 actors were found leveraging an RCE flaw in ManageEngine Desktop Central (CVE-2020-10189, CVSS score: 9.8) to download and execute malicious payloads in corporate networks as part of a global intrusion campaign.
_______________________________________________ BreachExchange mailing list sponsored by Risk Based Security BreachExchange () lists riskbasedsecurity com If you wish to Edit your membership or Unsubscribe you can do so at the following link: https://lists.riskbasedsecurity.com/listinfo/breachexchange
Current thread:
- CISA Warns of Actively Exploited Zoho ManageEngine ADSelfService Vulnerability Sophia Kingsbury (Sep 10)