PT-2020-8928 · Zoho · Zoho Manageengine Adselfservice Plus

Jason Juntunen + 1 · Published 2020-09-29 · Updated 2020-10-15 · CVE-2018-5353

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 5.5 build 5517

Description The issue allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the issue can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required.

Recommendations For versions prior to 5.5 build 5517, update to version 5.5 build 5517 or later to resolve the issue. As a temporary workaround, consider enforcing Network Level Authentication and ensuring the web server has a properly configured certificate to minimize the risk of exploitation. Restrict access to the custom GINA/CP module to minimize the risk of exploitation until the issue is resolved.

Exploit

Fix

RCE

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2018-5353

Affected Products

Zoho Manageengine Adselfservice Plus

References · 5

• 🔥 https://github.com/missing0x00/CVE-2018-5353 · Exploit
• https://osv.dev/vulnerability/CVE-2018-5353 · Vendor Advisory
• http://zoho.com · Vendor Advisory
• https://manageengine.com/products/self-service-password/release-notes.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5353 · Security Note