Zoho ManageEngine Multiple On-Premise Products SAML XML Signature Verification Remote Code Execution (RCE) Advisory (CVE-2022-47966)

1. Vulnerability Overview & Root Cause

This vulnerability exists in multiple Zoho ManageEngine on-premise products due to the integration of an outdated XML security library, Apache Santuario xmlsec (XML Security for Java) version 1.4.1. By design in this version, the xmlsec XSLT features delegate the responsibility of enforcing security protections to the calling application. Because the ManageEngine applications failed to implement these necessary security controls, they remained vulnerable to arbitrary XSLT execution during XML signature verification.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by targeting the SAML Single Sign-On (SSO) authentication flow. The attacker crafts a malicious SAML Response containing a <ds:Signature> element with an embedded XSLT transform (<ds:Transform Algorithm='http://www.w3.org/1999/XSL/Transform'>). When the ManageEngine server attempts to verify the signature of the SAML assertion, the Apache Santuario library processes the malicious XSLT payload. This triggers arbitrary Java code execution (e.g., via java.lang.Runtime.getRuntime().exec()) on the host operating system without requiring any prior authentication.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and its inclusion in the CISA KEV catalog, this vulnerability represents an extreme risk. Successful exploitation grants the attacker full administrative control over the ManageEngine server. Since these servers typically manage critical enterprise infrastructure (such as Active Directory, endpoints, and passwords), compromise can lead to domain-wide lateral movement, ransomware deployment, and catastrophic data exfiltration.