Headline
CVE-2023-35719: ZDI-23-891
ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM. Was ZDI-CAN-17009.
June 21st, 2023
(0Day) ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability****ZDI-23-891
ZDI-CAN-17009
CVE ID
CVE-2023-35719
CVSS SCORE
6.8, (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
AFFECTED VENDORS
ManageEngine
AFFECTED PRODUCTS
ADSelfService Plus
VULNERABILITY DETAILS
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM.
ADDITIONAL DETAILS
04/29/22 – The ZDI reported the vulnerability to the vendor.
05/01/22 – The vendor acknowledged the report.
07/13/22 – The vendor asked for additional details.
07/13/22 – The ZDI provided additional details.
08/09/22 – The vendor states they are investigating the report.
08/09/22 – The vendor asked for additional details.
08/09/22 – The ZDI provided additional details.
09/13/22 – The vendor states this vulnerability can be mitigated using the best practices.
04/19/23 – The ZDI asked for an update.
04/19/23 – The vendor states that following the best practice guidelines will mitigate this vulnerability and that they would consider
adding user alerts in a future release.
06/08/23 – The ZDI conducted a review, and we determined that the product is still vulnerable even with best practices implemented.
06/13/23 – The ZDI informed the vendor of our findings and that the case will be published as a zero-day advisory on 06/21/23.
– Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application.
DISCLOSURE TIMELINE
- 2022-04-29 - Vulnerability reported to vendor
- 2023-06-21 - Coordinated public release of advisory
CREDIT
Pedro Ribeiro ([email protected] | @pedrib1337), João Bigotte and Ashley King from Agile Information Security
BACK TO ADVISORIES