ManageEngine ADSelfService Plus <6121 - Stored Cross-Site Scripting

mediumseverity

6.1CVSS score

3.6%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

ManageEngine ADSelfService Plus before 6121 contains a stored cross-site scripting vulnerability via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screens.

Impact

Successful exploitation of this vulnerability could lead to the execution of arbitrary scripts or theft of sensitive information.

Fix

Upgrade to a version of ManageEngine ADSelfService Plus that is higher than 6121 to mitigate this vulnerability.

How to confirm it

Send: POST /servlet/GetProductVersion
Positive when: compare_versions(buildnumber, '< 6121') AND contains "ManageEngine" AND status 200

Run it with nuclei: nuclei -id CVE-2022-24681 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-24681

info:
  name: ManageEngine ADSelfService Plus <6121 - Stored Cross-Site Scripting
  author: Open-Sec
  severity: medium
  description: |
    ManageEngine ADSelfService Plus before 6121 contains a stored cross-site scripting vulnerability via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screens.
  impact: |
    Successful exploitation of this vulnerability could lead to the execution of arbitrary scripts or theft of sensitive information.
  remediation: |
    Upgrade to a version of ManageEngine ADSelfService Plus that is higher than 6121 to mitigate this vulnerability.
  reference:
    - https://raxis.com/blog/cve-2022-24681
    - https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-24681.html
    - https://manageengine.com
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24681
    - https://www.manageengine.com/products/self-service-password/kb/CVE-2022-24681.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-24681
    cwe-id: CWE-79
    epss-score: 0.03619
    epss-percentile: 0.89606
    cpe: cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zohocorp
    product: manageengine_adselfservice_plus
    shodan-query:
      - http.title:"manageengine"
      - http.title:"adselfservice plus"
    fofa-query:
      - title="manageengine"
      - title="adselfservice plus"
    google-query:
      - intitle:"adselfservice plus"
      - intitle:"manageengine"
  tags: cve,cve2022,manageengine,xss,authenticated,zohocorp,passive,vuln

http:
  - raw:
      - |
        POST /servlet/GetProductVersion HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - compare_versions(buildnumber, '< 6121')

      - type: word
        part: body
        words:
          - "ManageEngine"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: buildnumber
        group: 1
        regex:
          - '"BUILD_NUMBER":"([0-9]+)",'
        internal: true
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from