CVE-2021-31813

What it actually does

Zoho ManageEngine Applications Manager versions before 15130 improperly sanitize user details imported from Active Directory, allowing a stored cross-site scripting payload to be saved in fields such as a user name. When a privileged or administrative user later views the affected user details in the Applications Manager web interface, the injected JavaScript can execute in that user’s browser session. This can enable session hijacking where cookies or tokens are accessible, unauthorized actions through the victim’s authenticated session, UI manipulation, credential phishing, or pivoting to further application-level compromise.

Why it matters to the business

A successful exploit can let an attacker abuse trusted administrative sessions in a monitoring platform, potentially leading to unauthorized configuration changes, exposure of monitored asset information, disruption of monitoring operations, and loss of trust in alerting data. Although this is not listed in CISA KEV and is not known here as ransomware-linked, public exploit availability and a high EPSS score indicate meaningful likelihood of exploitation, so affected internet-facing or broadly accessible deployments should be prioritized for remediation.

How an attack unfolds

An attacker first needs the ability to influence Active Directory user details that Applications Manager imports, such as by creating or modifying an AD account attribute used as a displayed user name. The attacker places a JavaScript payload in that field. When Applications Manager imports or synchronizes the malicious user details, the payload is stored by the application without sufficient output encoding. Later, an authenticated user, commonly an administrator or operator, views the imported user record or another page that renders the crafted field. The browser executes the attacker-controlled script in the Applications Manager origin, allowing the attacker to perform actions as the victim, capture accessible session data, redirect the user, load external payloads, or modify application settings within the victim’s permissions.

How to fix it

Upgrade Zoho ManageEngine Applications Manager to version 15130 or later. If immediate upgrade is not possible, restrict access to the Applications Manager web console to trusted administrative networks, limit who can create or modify Active Directory attributes imported into the product, review and sanitize imported AD user fields, and enforce browser/session protections such as HttpOnly/SameSite cookies and strong re-authentication for sensitive actions where supported. Avoid relying on web application firewall rules alone because stored XSS payloads may enter through directory synchronization rather than direct web requests.

How to confirm the fix worked

Confirm the deployed Applications Manager version is 15130 or later. Review release/build information from the product console or installation metadata and compare it against the fixed threshold. In a non-production test environment, import a benign encoded test string resembling an HTML tag in an AD user-name field and verify it is displayed as text rather than executed by the browser. Validate that existing imported user records do not contain scriptable HTML or JavaScript event handlers. Confirm administrative access to the console is network-restricted and that AD change auditing is enabled for imported user attributes.

Typical attack path

1. Gain the ability to create or modify an Active Directory user attribute imported by Applications Manager.
2. Insert a stored XSS payload into a user detail field such as a crafted user name.
3. Wait for or trigger Active Directory import/synchronization into Applications Manager.
4. Induce or wait for an authenticated Applications Manager user to view the imported user details.
5. Execute JavaScript in the victim’s browser under the Applications Manager web origin.
6. Use the victim’s session to access sensitive monitoring data, change configuration, create persistence, or pivot to additional actions.

How to detect it

To determine whether exploitation already occurred, examine Active Directory audit logs for creation or modification of user attributes imported by Applications Manager, especially names or display fields containing HTML, JavaScript, URL-encoded script tags, or event-handler attributes. Review Applications Manager import, application, and web access logs around those AD changes for synchronization events and subsequent administrator views of user-management, AD-import, or account-detail pages. On administrator workstations, inspect browser history, proxy logs, DNS logs, and EDR telemetry for outbound connections to unusual domains immediately after accessing the Applications Manager console. Look for suspicious administrative actions in Applications Manager following page views of imported users, such as new users, privilege changes, altered monitors, disabled alerts, or configuration exports. Because this is stored XSS, direct exploit payloads may not appear only in HTTP request logs; directory-service audit trails and application database/content review are important evidence sources.

• <script
• </script>
• %3Cscript
• %3C%2Fscript%3E
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• document.cookie
• document.domain
• window.location
• eval(
• alert(
• new Image().src
• fetch(
• XMLHttpRequest
• fromCharCode
• ManageEngine/AppManager/logs
• AppManager/logs
• Applications Manager
• AD import
• Active Directory import

What your security team should do

• Patch or upgrade all Zoho ManageEngine Applications Manager instances to version 15130 or later, prioritizing internet-exposed or widely accessible deployments.
• Search Active Directory and Applications Manager records for user-name or display-name values containing HTML tags, JavaScript URI handlers, or event-handler attributes.
• Review Applications Manager access logs for administrators viewing imported user or AD integration pages shortly after suspicious AD user-attribute changes.
• Investigate any outbound web requests from administrator workstations to unfamiliar domains occurring immediately after using the Applications Manager console.
• Restrict Applications Manager administrative access through VPN, bastion hosts, or trusted management networks.
• Limit AD permissions that allow modification of user attributes consumed by Applications Manager.
• Rotate sessions and credentials for privileged users if evidence suggests a malicious script executed in an administrator browser.
• Add SIEM detections for script-like content in directory attributes and Applications Manager logs.