CVE-2022-28219

What it actually does

CVE-2022-28219 is an unauthenticated XML External Entity (XXE) vulnerability in the Cewolf component bundled with Zoho ManageEngine ADAudit Plus versions before build 7060. A remote attacker can send crafted XML that causes the server-side XML parser to resolve attacker-controlled external entities. In vulnerable deployments this can be chained beyond file disclosure and server-side request forgery into remote code execution, giving the attacker the ability to execute commands in the context of the ADAudit Plus service account. Because the flaw is network-accessible, requires no credentials, and has low attack complexity, successful exploitation can result in full confidentiality, integrity, and availability compromise of the ADAudit Plus application host.

Why it matters to the business

ADAudit Plus commonly has privileged visibility into Active Directory, authentication events, file access, and audit data. Compromise of this system can expose sensitive identity and audit information, provide an attacker with a foothold near domain administration workflows, enable tampering with security logs or reports, and disrupt audit/compliance operations. The vulnerability has a critical CVSS score, very high EPSS likelihood, and weaponized exploit maturity, so internet-facing or broadly reachable ADAudit Plus servers should be treated as high-priority remediation targets even though the issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a reachable ManageEngine ADAudit Plus instance running a build earlier than 7060. They then send a crafted request to functionality backed by the vulnerable Cewolf/XML-processing component. The payload includes XML constructs such as a DOCTYPE declaration and external entity references that force the server to fetch local files or contact attacker-controlled infrastructure. The attacker uses the XXE behavior to validate exploitability, leak local configuration or credential material, or perform server-side network requests. In vulnerable configurations, the attacker chains the parser behavior and application handling into command execution, causing the ADAudit Plus Java service to launch operating-system commands or write executable content. After code execution, the attacker may deploy a web shell, run reconnaissance commands, extract ADAudit Plus or domain-related data, create persistence, move laterally, or erase evidence from application and web logs.

How to fix it

Upgrade Zoho ManageEngine ADAudit Plus to build 7060 or later. If immediate upgrade is not possible, restrict network access to ADAudit Plus to trusted administrative networks or VPN users only, block direct internet exposure, and apply web application firewall rules that deny XML payloads containing DOCTYPE or external entity declarations where feasible. Disable or restrict vulnerable functionality if supported by the vendor, and ensure the Java/XML parser configuration disables external entity resolution, external DTD loading, and XInclude processing. Rotate credentials and API tokens stored on or used by the ADAudit Plus server if exploitation is suspected. Review service account privileges and run the application with the least privilege required.

How to confirm the fix worked

Confirm the installed ADAudit Plus build is 7060 or later using the product UI, version files, service banner, or vendor-supported version command. Verify external exposure by scanning known management ports and confirming ADAudit Plus is not reachable from untrusted networks. Test WAF or reverse-proxy controls with benign XML payloads containing strings such as <!DOCTYPE and <!ENTITY and confirm they are blocked or logged. Review application logs after patching to ensure malformed XML payloads no longer trigger external network callbacks or parser errors. Perform authenticated application smoke testing to confirm ADAudit Plus audit collection, reporting, and alerting continue to function after upgrade.

Typical attack path

1. Scan for exposed Zoho ManageEngine ADAudit Plus services and fingerprint vulnerable versions before build 7060.
2. Send a crafted unauthenticated request to the vulnerable Cewolf/XML-processing endpoint or feature.
3. Use XXE payloads containing external entities to trigger outbound callbacks, local file reads, or internal network requests.
4. Retrieve sensitive configuration, credential, or environment data to support further compromise.
5. Chain the XXE primitive into remote command execution where the vulnerable application permits it.
6. Execute commands under the ADAudit Plus service context and stage tools, web shells, or scripts.
7. Access or exfiltrate audit, identity, and configuration data from the compromised server.
8. Attempt lateral movement toward Active Directory or other internal management systems.
9. Clean up or modify logs and artifacts to hinder investigation.

How to detect it

Investigate web server, reverse proxy, WAF, ADAudit Plus application, Java service, and operating-system logs for signs of prior XXE and command execution. Prioritize requests containing XML metacharacters such as <!DOCTYPE, <!ENTITY, SYSTEM, PUBLIC, file://, jar://, gopher://, ldap://, http://, or attacker-controlled callback domains. Look for parser exceptions referencing external entity resolution, DTD loading, SAXParseException, DocumentBuilder, or Xerces. Review outbound DNS, HTTP, LDAP, and SMB traffic from ADAudit Plus servers to unusual external hosts, especially around suspicious web requests. On Windows, examine process creation logs, Sysmon Event ID 1, PowerShell logs, scheduled task logs, service creation logs, and security events for java.exe or wrapper.exe spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, mshta.exe, rundll32.exe, net.exe, or whoami.exe. On Linux, look for the ADAudit Plus Java process spawning /bin/sh, bash, curl, wget, python, perl, nc, or chmod. Inspect the ADAudit Plus installation directory and web application directories for recently created JSP files, scripts, archives, or binaries. Because the vulnerability has weaponized exploit maturity and very high EPSS, absence of KEV listing should not be treated as absence of exploitation risk.

• <!DOCTYPE
• <!ENTITY
• SYSTEM "file://
• SYSTEM 'file://
• SYSTEM "http://
• SYSTEM 'http://
• SYSTEM "https://
• SYSTEM 'https://
• SYSTEM "ldap://
• SYSTEM 'ldap://
• SYSTEM "jar://
• SYSTEM 'jar://
• SYSTEM "gopher://
• SYSTEM 'gopher://
• %xxe;
• /etc/passwd
• C:\\Windows\\win.ini
• SAXParseException
• DocumentBuilderFactory
• disallow-doctype-decl
• external-general-entities
• external-parameter-entities
• java.exe cmd.exe
• java.exe powershell.exe
• java.exe certutil.exe
• java.exe bitsadmin.exe
• java.exe mshta.exe
• java.exe wscript.exe
• java.exe cscript.exe
• java.exe rundll32.exe
• wrapper.exe cmd.exe
• wrapper.exe powershell.exe
• /bin/sh -c
• java /bin/sh
• java bash
• java curl
• java wget
• java nc
• ManageEngine/ADAudit Plus
• ManageEngine\\ADAudit Plus
• logs/serverout
• logs/wrapper.log
• .jsp
• cmd.jsp
• shell.jsp
• webshell.jsp

What your security team should do

• Patch all Zoho ManageEngine ADAudit Plus installations to build 7060 or later as an emergency priority, especially internet-facing systems.
• Inventory all ADAudit Plus servers, including disaster recovery, test, and legacy instances, because this class of vulnerability is frequently exploited against forgotten management systems.
• Restrict ADAudit Plus access to trusted administrative networks and remove direct public exposure.
• Hunt historical logs for XXE payload markers, suspicious Cewolf requests, unexpected outbound callbacks, and child processes spawned by the ADAudit Plus Java service.
• Inspect the ADAudit Plus host for web shells, unknown scripts, recently modified application files, suspicious scheduled tasks, new services, and unauthorized user accounts.
• Rotate application, database, directory, LDAP, and service account credentials if exploitation cannot be ruled out.
• Review Active Directory and identity audit logs for unusual queries, privileged account activity, and lateral movement originating from the ADAudit Plus server.
• Add SIEM detections for XML external entity patterns and Java service child-process execution on ADAudit Plus hosts.
• Preserve logs and forensic images before remediation if compromise is suspected.