PT-2022-19250 · Zoho · Zoho Manageengine Adselfservice Plus

Andrew Iwamaye + 3 · Published 2022-04-18 · Updated 2025-10-31 · CVE-2022-28810

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 6122

Description The issue allows a remote authenticated administrator to execute arbitrary operating system commands as SYSTEM via the policy custom script feature. This can be exploited due to the use of a default administrator password, making it easier for attackers to abuse this functionality. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field, specifically the password field. This vulnerability can be exploited when a certain password sync feature is enabled, which uses passwords as script arguments, allowing for remote code execution via executable CMD.EXE input.

Recommendations For versions prior to 6122, update to a version that includes the fix for this issue, specifically build 6122 or later, to prevent remote code execution. As a temporary workaround, consider disabling the policy custom script feature until a patch is available. Restrict access to the password sync feature that uses passwords as script arguments to minimize the risk of exploitation. Avoid using the password field in the custom script until the issue is resolved.

Exploit

Fix

OS Command Injection

Using Hardcoded Credentials

Weakness Enumeration

CWE-78

CWE-798

Related Identifiers

CVE-2022-28810

Affected Products

Zoho Manageengine Adselfservice Plus

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/pull/16475 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2022_28810.rb · Exploit
• 🔥 https://rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed · Exploit
• 🔥 http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html · Exploit
• https://manageengine.com/products/self-service-password/advisory/CVE-2022-28810.html · Security Note
• https://manageengine.com/products/self-service-password/kb/cve-2022-28810.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28810 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28810 · Vendor Advisory
• https://t.me/thehackernews/3125 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-28810 · Note
• https://t.me/cibsecurity/41007 · Telegram Post
• https://t.me/cvenotify/29103 · Telegram Post
• https://t.me/cveNotify/141119 · Telegram Post