Advisory Details

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM.

04/29/22 – The ZDI reported the vulnerability to the vendor.

05/01/22 – The vendor acknowledged the report.

07/13/22 – The vendor asked for additional details.

07/13/22 – The ZDI provided additional details.

08/09/22 – The vendor states they are investigating the report.

08/09/22 – The vendor asked for additional details.

08/09/22 – The ZDI provided additional details.

09/13/22 – The vendor states this vulnerability can be mitigated using the best practices.

04/19/23 – The ZDI asked for an update.

04/19/23 – The vendor states that following the best practice guidelines will mitigate this vulnerability and that they would consider
adding user alerts in a future release.

06/08/23 – The ZDI conducted a review, and we determined that the product is still vulnerable even with best practices implemented.

06/13/23 – The ZDI informed the vendor of our findings and that the case will be published as a zero-day advisory on 06/21/23.

-- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application.

• 2022-04-29 - Vulnerability reported to vendor
• 2023-06-21 - Coordinated public release of advisory