PT-2023-1059 · Zoho+1 · Active Directory 360+24

Khoadha · Publicado 2023-01-13 · Atualizado 2025-10-31 · CVE-2022-47966

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 14004 Zoho ManageEngine Access Manager Plus versions prior to 4308 Zoho ManageEngine Active Directory 360 versions prior to 4310 Zoho ManageEngine ADAudit Plus versions prior to 7081 Zoho ManageEngine ADManager Plus versions prior to 7162 Zoho ManageEngine ADSelfService Plus versions prior to 6211 Zoho ManageEngine Analytics Plus versions prior to 5150 Zoho ManageEngine Application Control Plus versions prior to 10.1.2220.18 Zoho ManageEngine Asset Explorer versions prior to 6983 Zoho ManageEngine Browser Security Plus versions prior to 11.1.2238.6 Zoho ManageEngine Device Control Plus versions prior to 10.1.2220.18 Zoho ManageEngine Endpoint Central versions prior to 10.1.2228.11 Zoho ManageEngine Endpoint Central MSP versions prior to 10.1.2228.11 Zoho ManageEngine Endpoint DLP versions prior to 10.1.2137.6 Zoho ManageEngine Key Manager Plus versions prior to 6401 Zoho ManageEngine OS Deployer versions prior to 1.1.2243.1 Zoho ManageEngine PAM 360 versions prior to 5713 Zoho ManageEngine Password Manager Pro versions prior to 12124 Zoho ManageEngine Patch Manager Plus versions prior to 10.1.2220.18 Zoho ManageEngine Remote Access Plus versions prior to 10.1.2228.11 Zoho ManageEngine Remote Monitoring and Management (RMM) versions prior to 10.1.41 Zoho ManageEngine ServiceDesk Plus MSP versions prior to 13001 Zoho ManageEngine SupportCenter Plus versions prior to 11026 Zoho ManageEngine Vulnerability Manager Plus versions prior to 10.1.2220.18

Description The issue is related to the use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1 in multiple Zoho ManageEngine on-premise products, which allows remote code execution due to the xmlsec XSLT features making the application responsible for certain security protections that the ManageEngine applications did not provide. Exploitation is only possible if SAML SSO has ever been configured for a product. The vulnerability has been exploited by the North Korean state-backed hacker group Lazarus to compromise internet backbone infrastructure providers and healthcare organizations.

Recommendations For Zoho ManageEngine ServiceDesk Plus versions prior to 14004, update to version 14004 or later. For Zoho ManageEngine Access Manager Plus versions prior to 4308, update to version 4308 or later. For Zoho ManageEngine Active Directory 360 versions prior to 4310, update to version 4310 or later. For Zoho ManageEngine ADAudit Plus versions prior to 7081, update to version 7081 or later. For Zoho ManageEngine ADManager Plus versions prior to 7162, update to version 7162 or later. For Zoho ManageEngine ADSelfService Plus versions prior to 6211, update to version 6211 or later. For Zoho ManageEngine Analytics Plus versions prior to 5150, update to version 5150 or later. For Zoho ManageEngine Application Control Plus versions prior to 10.1.2220.18, update to version 10.1.2220.18 or later. For Zoho ManageEngine Asset Explorer versions prior to 6983, update to version 6983 or later. For Zoho ManageEngine Browser Security Plus versions prior to 11.1.2238.6, update to version 11.1.2238.6 or later. For Zoho ManageEngine Device Control Plus versions prior to 10.1.2220.18, update to version 10.1.2220.18 or later. For Zoho ManageEngine Endpoint Central versions prior to 10.1.2228.11, update to version 10.1.2228.11 or later. For Zoho ManageEngine Endpoint Central MSP versions prior to 10.1.2228.11, update to version 10.1.2228.11 or later. For Zoho ManageEngine Endpoint DLP versions prior to 10.1.2137.6, update to version 10.1.2137.6 or later. For Zoho ManageEngine Key Manager Plus versions prior to 6401, update to version 6401 or later. For Zoho ManageEngine OS Deployer versions prior to 1.1.2243.1, update to version 1.1.2243.1 or later. For Zoho ManageEngine PAM 360 versions prior to 5713, update to version 5713 or later. For Zoho ManageEngine Password Manager Pro versions prior to 12124, update to version 12124 or later. For Zoho ManageEngine Patch Manager Plus versions prior to 10.1.2220.18, update to version 10.1.2220.18 or later. For Zoho ManageEngine Remote Access Plus versions prior to 10.1.2228.11, update to version 10.1.2228.11 or later. For Zoho ManageEngine Remote Monitoring and Management (RMM) versions prior to 10.1.41, update to version 10.1.41 or later. For Zoho ManageEngine ServiceDesk Plus MSP versions prior to 13001, update to version 13001 or later. For Zoho ManageEngine SupportCenter Plus versions prior to 11026, update to version 11026 or later. For Zoho ManageEngine Vulnerability Manager Plus versions prior to 10.1.2220.18, update to version 10.1.2220.18 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-00171

CVE-2022-47966

Produtos afetados

Adaudit Plus

Admanager Plus

Adselfservice Plus

Access Manager Plus

Active Directory 360

Analytics Plus

Apache Santuario Xmlsec

Zoho Application Control Plus

Assetexplorer

Browser Security Plus

Device Control Plus

Endpoint Central

Endpoint Central Msp

Endpoint Dlp

Key Manager Plus

Os Deployer

Pam 360

Password Manager Pro

Patch Manager Plus

Remote Access Plus

Remote Monitoring/Management

Servicedesk Plus

Servicedesk Plus Msp

Supportcenter Plus

Vulnerability Manager Plus

Referências · 176

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/manageengine_servicedesk_plus_saml_rce_cve_2022_47966.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966.rb · Exploit
• 🔥 https://github.com/horizon3ai/CVE-2022-47966 · Exploit
• 🔥 https://github.com/vonahisec/CVE-2022-47966-Scan · Exploit
• 🔥 https://github.com/Inplex-sys/CVE-2022-47966 · Exploit
• 🔥 https://github.com/shameem-testing/PoC-for-ME-SAML-Vulnerability · Exploit
• 🔥 https://blog.viettelcybersecurity.com/saml-show-stopper · Exploit
• 🔥 http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html · Exploit
• 🔥 https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis · Exploit
• 🔥 http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html · Exploit
• 🔥 https://horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive · Exploit
• 🔥 http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html · Exploit
• https://github.com/JPCERTCC/LogonTracer · Nota
• https://github.com/0x09AL/IIS-Raid · Nota