CVE-2021-33256

What it actually does

The issue is a CSV/formula injection weakness in the ManageEngine ADSelfService Plus login workflow, reported for version 6.1 build 6101. An unauthenticated attacker can submit a crafted value in the j_username parameter that is stored in login-attempt audit data. If a privileged user later exports the “User Attempts Audit Report” to CSV and opens it in a spreadsheet application that evaluates formulas or external data commands, the attacker-controlled cell content may execute spreadsheet formulas and, in unsafe configurations, launch commands or retrieve remote content. The vulnerability requires user interaction by an operator who exports and opens the CSV, but it does not require the attacker to authenticate. The vendor has disputed the report and no definitive fixed version is listed, so exposure should be evaluated based on product behavior and compensating controls.

Why it matters to the business

Successful exploitation can turn a routine administrative report export into code execution on the workstation of an administrator or helpdesk operator. Because ADSelfService Plus is commonly tied to identity and password-management workflows, compromise of an administrator workstation could lead to credential theft, lateral movement, directory service abuse, data exposure, or operational disruption. The high EPSS score and public exploit availability indicate meaningful exploitation interest, even though the vulnerability is not currently in the CISA KEV catalog and the vendor disputes the finding.

How an attack unfolds

An attacker first reaches the public or internal ADSelfService Plus login page and submits a login attempt where the username field contains CSV formula syntax instead of a normal username. The application records that value in its user-attempt audit data. Later, an administrator or other privileged user exports the User Attempts Audit Report as a CSV file. If the exported CSV preserves the attacker-supplied formula without neutralization, and the administrator opens it in a spreadsheet program that evaluates the cell, the payload may run as a formula, fetch remote content, or, in vulnerable spreadsheet configurations, invoke operating-system commands. The resulting execution occurs in the context of the user opening the spreadsheet, not on the ADSelfService Plus server itself, which can allow theft of credentials, remote shell access from the administrator workstation, or further intrusion into identity infrastructure.

How to fix it

Because no authoritative fixed version is provided and the vendor disputes the issue, organizations should verify behavior directly and apply layered mitigations. Upgrade ADSelfService Plus to the latest available build supported by Zoho/ManageEngine and confirm whether CSV export hardening is present. Ensure CSV exports neutralize cells beginning with formula-triggering characters such as =, +, -, @, tab, and carriage return, commonly by prefixing a single quote or otherwise encoding the value so it is interpreted as text. Restrict access to report-export functionality to the minimum number of trusted administrators. Avoid opening exported administrative CSV files directly on privileged workstations; use safe viewers or import workflows that treat all columns as text. Configure Microsoft Office, LibreOffice, or equivalent spreadsheet tools to disable DDE, external links, automatic formula execution from untrusted files, and macros where possible. Place exported reports in Protected View or open them in a sandboxed environment. If the login panel is internet-facing, restrict access using VPN, IP allowlisting, or reverse-proxy controls where operationally feasible.

How to confirm the fix worked

Confirm the installed ADSelfService Plus version and build, with particular attention to version 6.1 build 6101 and any older or unverified builds. Perform a controlled test using a harmless username value that begins with formula syntax, such as a benign test string beginning with =, then export the User Attempts Audit Report as CSV. Inspect the raw CSV in a text editor, not a spreadsheet, and verify that the value is encoded or prefixed so it cannot be interpreted as a formula. Open the file only in a controlled sandbox to confirm that spreadsheet software displays the value as plain text and does not evaluate it. Validate that only authorized personnel can export audit reports. Confirm endpoint controls generate alerts when spreadsheet applications spawn command interpreters, scripting engines, or outbound network connections.

Typical attack path

1. Identify an accessible ManageEngine ADSelfService Plus login panel.
2. Submit an unauthenticated login attempt with a crafted j_username value beginning with spreadsheet formula-control characters such as =, +, -, @, tab, or carriage return.
3. Rely on ADSelfService Plus to store the supplied value in login-attempt audit records.
4. Wait for a privileged user to export the User Attempts Audit Report as a CSV file.
5. Induce or wait for the privileged user to open the CSV in a spreadsheet application that evaluates formulas or external commands.
6. Achieve command execution, remote content retrieval, or credential exposure on the workstation of the user opening the report.
7. Use the compromised workstation or credentials to move laterally, access directory services, or escalate the attack.

How to detect it

Look for evidence in three places: ADSelfService Plus login/audit records, report-export activity, and administrator endpoint telemetry. In application and web access logs, search for unauthenticated login attempts where j_username contains spreadsheet formula markers, URL-encoded formula characters, shell commands, external URLs, or strings associated with DDE-style payloads. Review ADSelfService Plus audit events for exports of the User Attempts Audit Report, especially exports occurring after suspicious failed login attempts. On administrator workstations, review Windows Security Event ID 4688, Sysmon Event ID 1, EDR process trees, and PowerShell logs for spreadsheet applications launching command interpreters or scripting tools. Review Sysmon Event ID 3, proxy, DNS, and firewall logs for outbound connections initiated by spreadsheet applications or immediately after a CSV report was opened. Also search for downloaded or exported CSV files containing formula payloads in user download directories, temporary directories, email attachments, and file shares used for administrative reporting.

• j_username==
• j_username=%3D
• j_username=+
• j_username=%2B
• j_username=-
• j_username=%2D
• j_username=@
• j_username=%40
• j_username=%09
• j_username=%0D
• =cmd|
• cmd|'/C
• cmd.exe /c
• powershell -nop
• powershell -enc
• powershell.exe -EncodedCommand
• =HYPERLINK(
• =WEBSERVICE(
• =IMPORTXML(
• =DDE(
• User Attempts Audit Report
• excel.exe -> cmd.exe
• excel.exe -> powershell.exe
• excel.exe -> wscript.exe
• excel.exe -> cscript.exe
• excel.exe -> mshta.exe
• soffice.bin -> cmd.exe
• soffice.bin -> powershell.exe
• C:\ManageEngine\ADSelfService Plus\logs\
• ADSelfService Plus\logs

What your security team should do

• Treat this as a high-priority exposure where ADSelfService Plus is externally reachable or where administrators open exported CSV files on privileged workstations, due to public exploit availability and high EPSS probability.
• Upgrade ADSelfService Plus to the latest vendor-supported build and request written clarification from the vendor on CSV export sanitization behavior for audit reports.
• Test CSV export behavior for formula neutralization before considering the exposure remediated.
• Restrict report-export permissions and require exported reports to be opened only on hardened, non-privileged, or sandboxed workstations.
• Harden spreadsheet applications by disabling DDE, external content, macros, and automatic link updates for untrusted CSV files.
• Create EDR/SIEM detections for spreadsheet processes spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, or making unexpected outbound connections.
• Review historical ADSelfService Plus login-attempt records for username values containing formula syntax or URL-encoded formula characters.
• Review administrator workstation telemetry around the times User Attempts Audit Reports were exported or opened.
• If suspicious payloads are found, rotate potentially exposed administrator credentials and investigate for lateral movement into identity systems.