CVE-2021-37415

What it actually does

Zoho ManageEngine ServiceDesk Plus versions before 11302 improperly expose certain REST API URLs without enforcing authentication. A remote, unauthenticated attacker can send network requests directly to affected API endpoints and perform actions that should require a valid session or API key. Depending on the exposed endpoint and deployment configuration, this can allow unauthorized access to service desk data, modification of tickets or configuration, disruption of workflows, and potential follow-on compromise using information or privileges obtained through the API.

Why it matters to the business

This vulnerability can let an external attacker interact with a help desk platform without logging in, potentially exposing sensitive support tickets, employee details, asset information, internal troubleshooting notes, credentials accidentally stored in tickets, and operational workflows. Because it is listed in CISA KEV, has a very high EPSS score, and has been exploited in the wild, internet-facing ServiceDesk Plus instances should be treated as high-priority remediation targets even though it was published in 2021.

How an attack unfolds

An attacker first identifies an internet-accessible Zoho ManageEngine ServiceDesk Plus instance and fingerprints its version or behavior to determine whether it is older than build 11302. The attacker then sends unauthenticated HTTP requests directly to vulnerable REST API paths that fail to enforce the normal login or API-key checks. If the instance is vulnerable, the server processes the request as though it were authorized, allowing the attacker to read or manipulate data exposed by those API functions. The attacker may then enumerate tickets, users, assets, attachments, or configuration details; modify records to disrupt operations; or use harvested internal information to support phishing, credential theft, lateral movement, or additional attacks against the organization.

How to fix it

Upgrade Zoho ManageEngine ServiceDesk Plus to build 11302 or later immediately. If immediate upgrade is not possible, restrict access to the ServiceDesk Plus web interface and REST API to trusted networks or VPN users only, block direct internet access, and enforce web application firewall or reverse-proxy rules that require authentication before API access. Rotate any API keys, service credentials, or passwords that may have been stored in tickets or attachments. Review user accounts, technician roles, integrations, and recent ticket modifications for unauthorized changes. Because this vulnerability is in CISA KEV with a remediation due date of 2021-12-15 and has active in-the-wild exploitation, compensating controls should be considered temporary only.

How to confirm the fix worked

Confirm the installed ServiceDesk Plus build is 11302 or later using the product UI, build information page, or vendor-supported version command/documentation. From an unauthenticated browser or HTTP client, attempt to access REST API endpoints that should require authentication and verify they return a login redirect, 401, 403, or equivalent authorization failure rather than data or successful state changes. Review reverse proxy, load balancer, and application logs to confirm unauthenticated API access is blocked. If a WAF or network restriction is used as a temporary mitigation, test from both trusted and untrusted network locations to verify the API is not reachable anonymously.

Typical attack path

1. Scan the internet or target network for exposed Zoho ManageEngine ServiceDesk Plus services.
2. Fingerprint the application version, build number, headers, login page, static assets, or API behavior to identify versions before 11302.
3. Send unauthenticated requests to REST API URLs that are improperly accessible without a valid session or API key.
4. Confirm exploitation by observing successful API responses, returned records, or state changes instead of authentication errors.
5. Enumerate accessible tickets, users, assets, attachments, or workflow data.
6. Modify or delete records where the exposed API functionality permits write operations.
7. Use collected operational data, credentials in tickets, or internal system details for follow-on intrusion, social engineering, or persistence.

How to detect it

Review ServiceDesk Plus access logs, application logs, reverse proxy logs, load balancer logs, WAF logs, and network telemetry for REST API requests that were accepted without a prior authenticated session, API key, or expected identity context. Focus on requests from external or unfamiliar IP addresses, high-volume enumeration of API endpoints, successful 200-series responses to API paths from clients that did not first access the login flow, and write-method requests such as POST, PUT, PATCH, or DELETE against API endpoints. Correlate API activity with ticket, user, asset, attachment, and configuration audit logs to identify unauthorized reads, exports, modifications, deletions, or newly created records. Investigate unusual user-agent strings, scripted clients, missing referrers, repeated probing of API paths, and requests that occurred before the upgrade to build 11302 or later. Because this issue is known to have been exploited in the wild and is in the CISA KEV catalog, perform retrospective hunting over the maximum available log retention period for any instance that was internet-accessible while vulnerable.

• /RestAPI/
• /api/v3/
• GET /RestAPI/
• POST /RestAPI/
• PUT /RestAPI/
• DELETE /RestAPI/
• GET /api/v3/
• POST /api/v3/
• PUT /api/v3/
• DELETE /api/v3/
• HTTP 200 responses to /RestAPI/ requests without an authenticated session cookie
• HTTP 200 responses to /api/v3/ requests without an authenticated session cookie
• Unauthenticated REST API request to Zoho ManageEngine ServiceDesk Plus
• ManageEngine ServiceDesk Plus build before 11302

What your security team should do

• Immediately identify all Zoho ManageEngine ServiceDesk Plus deployments, especially internet-facing systems, and confirm whether any are running builds before 11302.
• Patch or upgrade affected instances to build 11302 or later as the top priority.
• If patching cannot be completed immediately, remove public exposure and allow access only through VPN, trusted administrative networks, or authenticated reverse proxies.
• Hunt historical logs for unauthenticated or suspicious REST API requests, especially before the patch date and around periods of elevated scanning activity.
• Review tickets, attachments, user records, technician accounts, asset records, integrations, and configuration changes for unauthorized access or modification.
• Rotate credentials, API keys, webhook secrets, and integration tokens that may have been stored in ServiceDesk Plus tickets, notes, attachments, or configuration.
• Increase monitoring for abnormal API usage, unusual ticket exports, bulk reads, unexpected writes, and requests from unfamiliar external IP addresses.
• Preserve relevant application, web server, proxy, and endpoint logs before log rotation if exploitation is suspected.
• Treat any vulnerable internet-exposed instance as potentially compromised until log review and application integrity checks are complete.