CVE-2021-40539

What it actually does

Zoho ManageEngine ADSelfService Plus 6113 and earlier contains an authentication bypass in REST API handling that allows an unauthenticated network attacker to reach privileged functionality and achieve remote code execution. In practical exploitation, attackers abuse exposed REST endpoints to write or deploy server-side code, commonly JSP web shells, under the ADSelfService Plus web application. Code then executes with the privileges of the ADSelfService Plus service account, enabling command execution, file access, credential theft, persistence, and pivoting into connected identity infrastructure such as Active Directory.

Why it matters to the business

This is a critical, remotely exploitable identity-service vulnerability with a very high likelihood of exploitation, known in-the-wild activity, CISA KEV listing, and reported ransomware use. A compromised ADSelfService Plus server can give attackers a foothold close to password reset, directory, and authentication workflows, creating risk of credential theft, domain compromise, service disruption, data theft, and ransomware deployment. Because the CISA remediation deadline was 2021-11-17 and exploitation has been public for years, any internet-exposed or unpatched instance should be treated as high-risk and potentially already compromised.

How an attack unfolds

An attacker first identifies an exposed ADSelfService Plus server running build 6113 or earlier. They send crafted unauthenticated requests to vulnerable REST API paths to bypass normal authentication checks. After reaching functionality intended only for authenticated users, the attacker abuses customization or upload behavior to place malicious JSP content into the web application directory. The attacker then requests the newly written JSP web shell over HTTP/S and uses it to execute operating-system commands under the ADSelfService Plus service context. From there, common follow-on activity includes deploying additional web shells or backdoors, enumerating the host and domain, harvesting credentials or tokens, dumping files, creating persistence, moving laterally, and, in ransomware-motivated intrusions, staging encryption or extortion tooling.

How to fix it

Upgrade Zoho ManageEngine ADSelfService Plus to build 6114 or later immediately; where possible, upgrade to the latest available build rather than only the first fixed build. If immediate upgrade is not possible, remove the service from direct internet exposure, restrict access to trusted administrative networks or VPN, block vulnerable REST API access at a reverse proxy or WAF where feasible, and monitor aggressively until upgraded. After patching, perform compromise assessment before returning the service to normal operation because patching does not remove existing web shells, backdoors, stolen credentials, or persistence. Rotate credentials and secrets accessible to the ADSelfService Plus application, including service-account credentials and directory integration secrets, if compromise is suspected or cannot be ruled out.

How to confirm the fix worked

Confirm the installed ADSelfService Plus build is 6114 or later from the product UI, build information files, or package inventory. Validate that no internet-facing endpoint is still exposing an unpatched build by using authenticated inventory, vulnerability scanning, and external attack-surface checks. Review the ADSelfService Plus installation directories for unexpected JSP files, recently modified web content, or files outside the normal product baseline. Confirm vulnerable REST API requests are no longer accepted without authentication. Verify that compensating controls are in place if the service must remain reachable, including network allowlisting, WAF rules, logging, and EDR coverage. Where a compromise assessment was performed, validate that no web shells, suspicious scheduled tasks, unauthorized services, abnormal Java child processes, or unexplained outbound connections remain.

Typical attack path

1. Scan for internet-accessible Zoho ManageEngine ADSelfService Plus portals.
2. Determine whether the target is running ADSelfService Plus build 6113 or earlier, or probe vulnerable REST API behavior directly.
3. Send crafted unauthenticated requests to REST API endpoints to bypass authentication.
4. Abuse reachable customization or upload functionality to write a JSP web shell into the ADSelfService Plus web root.
5. Invoke the web shell over HTTP/S to run commands as the ADSelfService Plus service account.
6. Execute discovery commands, inspect configuration, and collect credentials or directory-related secrets.
7. Deploy additional tooling such as backdoors, credential dumpers, tunneling utilities, or ransomware staging scripts.
8. Move laterally to directory services, file servers, backup systems, or other high-value assets.

How to detect it

Review ADSelfService Plus access logs, Tomcat or embedded web server logs, reverse proxy logs, WAF logs, EDR process telemetry, Windows Security logs, Sysmon events, file integrity monitoring, and network egress logs. Look for unauthenticated or unusual requests to REST API paths such as LogonCustomization or Connection, followed by requests to newly created JSP files. Correlate HTTP requests with filesystem creation or modification events under ADSelfService Plus webapps directories. Hunt for suspicious JSP files in web-accessible locations, especially files with names that do not match the product baseline or were created around the time of suspicious API requests. Investigate Java service processes spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, certutil.exe, bitsadmin.exe, whoami.exe, net.exe, nltest.exe, ipconfig.exe, or archive tools. Review outbound connections from the ADSelfService Plus host to unfamiliar external IPs, especially shortly after web shell access. Because this vulnerability has been used in ransomware and long-running intrusion campaigns, also look for credential dumping, domain enumeration, new local or domain accounts, scheduled tasks, services, remote access tools, and evidence of lateral movement from the ADSelfService Plus server.

• /RestAPI/LogonCustomization
• /RestAPI/Connection
• /help/admin-guide/Reports/ReportGenerate.jsp
• /html/promotion/adap.jsp
• /html/promotion/selfservice.jsp
• ReportGenerate.jsp
• adap.jsp
• selfservice.jsp
• C:\ManageEngine\ADSelfService Plus\webapps\adssp\help\admin-guide\Reports\ReportGenerate.jsp
• C:\ManageEngine\ADSelfService Plus\webapps\adssp\html\promotion\adap.jsp
• C:\ManageEngine\ADSelfService Plus\webapps\adssp\html\promotion\selfservice.jsp
• ManageEngine\ADSelfService Plus\webapps\adssp\html\promotion\
• java.exe spawned cmd.exe
• java.exe spawned powershell.exe
• Godzilla
• NGLite
• KdcSponge

What your security team should do

• Immediately identify all Zoho ManageEngine ADSelfService Plus instances and prioritize any internet-exposed systems.
• Upgrade all affected instances from build 6113 or earlier to build 6114 or later, preferably the latest supported build.
• Because this vulnerability is in CISA KEV and associated with ransomware activity, treat unpatched exposed systems as potentially compromised, not merely vulnerable.
• Perform forensic review of web access logs, ADSelfService Plus logs, filesystem changes, EDR telemetry, and outbound network traffic dating back to at least the public disclosure period or the earliest available logs.
• Search for JSP web shells and unexpected files under ADSelfService Plus web application directories, especially recently created or modified files.
• Hunt for Java or Tomcat service processes spawning command shells, PowerShell, scripting engines, archive tools, credential tools, or network utilities.
• Rotate ADSelfService Plus service-account passwords, directory integration credentials, API keys, and any secrets stored on or accessible from the server if exploitation is suspected.
• Restrict management and user access to ADSelfService Plus with network allowlisting, VPN, reverse proxy controls, and multifactor authentication where supported.
• Add SIEM detections for unauthenticated requests to known vulnerable REST API paths and for execution of suspicious JSP files under ADSelfService Plus paths.
• If web shells or post-exploitation artifacts are found, escalate to incident response, isolate the host, preserve evidence, and investigate lateral movement and credential compromise.