Zoho ManageEngine ADSelfService Plus Remote OS Command Execution and Credential Abuse Vulnerability (CVE-2022-28810) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-28810) is a critical security flaw in Zoho ManageEngine ADSelfService Plus involving policy custom script execution and input validation failures. First, the application suffers from the use of default administrator credentials, allowing attackers to easily gain administrative access (CWE-798). Second, an OS Command Injection vulnerability (CWE-78) exists within the custom script configuration, where an unsanitized password field allows partially authenticated attackers to inject arbitrary commands.

2. Exploitation Mechanics & Attack Scenario

An attacker can leverage default credentials or exploit the lack of sanitization in the password field to establish an authenticated session. Once authenticated, the attacker manipulates the 'Custom Script' execution policy by injecting malicious command separators (such as semicolons or pipelines) into the unsanitized input fields. When the policy script is triggered, the injected commands are executed under the security context of 'NT AUTHORITY\SYSTEM', leading to complete host compromise.

3. Infrastructure & Business Impact

Since ADSelfService Plus manages Active Directory (AD) credentials and user identities, a compromise of this system is highly critical. An attacker achieving SYSTEM privileges on this server can perform lateral movement to AD Domain Controllers, harvest domain credentials, deploy ransomware, and compromise the entire corporate network infrastructure.