Zoho ManageEngine PoC Exploit to be Released Soon – Patch Before It’s Too Late!

Jan 17, 2023Ravie LakshmananCyber Threat / Vulnerability

Users of Zoho ManageEngine are being urged to patch their
instances against a critical security vulnerability ahead of the
release of a proof-of-concept (PoC^[1]) exploit code.

The issue in question is CVE-2022-47966, an
unauthenticated remote code execution vulnerability affecting
several products due to the use of an outdated third-party
dependency, Apache Santuario.

“This vulnerability allows an unauthenticated adversary to
execute arbitrary code,” Zoho warned^[2]
in an advisory issued late last year, noting that it affects all
ManageEngine setups that have the SAML single sign-on (SSO) feature
enabled, or had it enabled in the past.

Horizon3.ai has now released Indicators of Compromise (IOCs)
associated with the flaw, noting that it was able to successfully
reproduce the exploit against ManageEngine ServiceDesk Plus and
ManageEngine Endpoint Central products.

“The vulnerability is easy to exploit and a good candidate for
attackers to ‘spray and pray’ across the internet,” researcher
James Horseman said^[3]. “This vulnerability
allows for remote code execution as NT AUTHORITY\SYSTEM,
essentially giving an attacker complete control over the
system.”

An attacker in possession of such elevated privileges could
weaponize it to steal credentials with the goal of conducting
lateral movement, the San Francisco-headquartered firm said, adding
the threat actor will need to send a specially crafted SAML request
to trigger the exploit.

Horizon3.ai further called attention to the fact that there are
more than 1,000 instances of ManageEngine products exposed to the
internet with SAML currently enabled, potentially turning them into
lucrative targets.

It’s not uncommon for hackers to exploit awareness of a major
vulnerability for malicious campaigns. It’s therefore essential
that the fixes are installed as soon as possible irrespective of
the SAML configuration.