CVE-2022-28810

What it actually does

The vulnerability allows command injection and arbitrary operating-system command execution in Zoho ManageEngine ADSelfService Plus before build 6122. An authenticated administrator can abuse the policy custom script feature to run commands with the privileges of the ADSelfService Plus service, commonly SYSTEM on Windows. The description also notes that weak/default administrator credentials and insufficient sanitization of a password field can reduce the practical authentication barrier, allowing a remote partially authenticated attacker to inject commands. Successful exploitation provides full confidentiality, integrity, and availability impact on the application host and can be used to deploy tools, create accounts, dump credentials, or pivot into directory-integrated infrastructure.

Why it matters to the business

Because ADSelfService Plus is commonly connected to identity and password-management workflows, compromise can affect authentication operations, user self-service password reset, account unlock processes, and potentially broader Active Directory security. This issue is listed in CISA KEV with a remediation due date of 2023-03-28 and has a high EPSS score, indicating meaningful real-world exploitation likelihood. Organizations running exposed or unpatched instances should treat this as an urgent identity-infrastructure risk even though the nominal CVSS score is moderate, because attacker access to the host can lead to credential theft, service disruption, lateral movement, and loss of trust in password-management processes.

How an attack unfolds

An attacker first identifies an accessible ADSelfService Plus instance and attempts to authenticate, either with valid administrative credentials, stolen credentials, or weak/default administrator credentials if present. After gaining sufficient access, the attacker configures or modifies the policy custom script functionality, or abuses the insufficiently sanitized password field, to inject operating-system command syntax. The vulnerable server executes the attacker-supplied command in the context of the ADSelfService Plus service account. On Windows deployments this may run as SYSTEM, giving the attacker high-privilege code execution. The attacker may then stage additional payloads, open reverse shells, add local users, dump credentials from memory or disk, alter application configuration, and use the compromised identity-management server as a foothold for Active Directory reconnaissance and lateral movement. Public reporting and KEV inclusion indicate exploitation has occurred in the wild for this ManageEngine ADSelfService Plus remote code execution issue.

How to fix it

Upgrade Zoho ManageEngine ADSelfService Plus to build 6122 or later. Remove any default administrator credentials, rotate all ADSelfService Plus administrative passwords, and enforce MFA for administrative access. Restrict ADSelfService Plus management interfaces to trusted administrative networks or VPNs, and avoid exposing the service directly to the internet. Review and disable unnecessary custom script functionality, remove untrusted scripts, and apply least-privilege service account configuration where supported. For the package data supplied, Debian 11 should be updated to 5.10.158-1 and Debian 12/13 to 6.0.12-1 where those packages are in scope. After patching, restart the service as required and validate that the running build/package version reflects the fixed release.

How to confirm the fix worked

Confirm the application reports ADSelfService Plus build 6122 or later from the product UI, version file, or service logs. Verify no default administrative password remains active and that administrative authentication requires strong credentials and preferably MFA. Review product configuration to confirm policy custom scripts are expected, documented, and free of shell metacharacters or suspicious download/execution commands. From the host, validate that the service is not reachable from untrusted networks and that management access is filtered. For Debian-packaged assets in scope, confirm installed package versions are at least Debian 11 5.10.158-1 or Debian 12/13 6.0.12-1 as applicable. Conduct a controlled negative test by submitting benign metacharacter input in the previously vulnerable field and confirming it is rejected, escaped, or treated as data rather than executed.

Typical attack path

1. Discover an internet-accessible or internally reachable Zoho ManageEngine ADSelfService Plus instance.
2. Authenticate using valid administrator credentials, stolen credentials, or weak/default administrator credentials where still configured.
3. Access the policy custom script functionality or vulnerable workflow that processes an unsanitized password field.
4. Inject shell metacharacters or command syntax into the script or vulnerable input field.
5. Trigger the vulnerable functionality so the server executes the injected operating-system command.
6. Establish persistence or interactive access by launching a shell, downloading tooling, creating accounts, or modifying scheduled tasks/services.
7. Perform credential theft, directory reconnaissance, lateral movement, or destructive actions from the compromised host.

How to detect it

Review ADSelfService Plus application logs, web access logs, administrator audit logs, operating-system security logs, EDR telemetry, and network proxy/DNS logs for evidence of exploitation. Focus on successful administrator logins followed by changes to policy custom scripts, password reset or password change requests containing shell metacharacters, and process creation where the ADSelfService Plus Java/service process launches operating-system shells or scripting tools. On Windows, examine Event ID 4688, Sysmon Event ID 1, service creation events, scheduled task events, PowerShell logs, and Defender/EDR alerts for suspicious child processes running as SYSTEM from the ADSelfService Plus service. On Linux, examine shell history, auditd execve records, cron changes, systemd service changes, and web/application logs under the ADSelfService Plus installation directory. Network hunts should look for the server making unexpected outbound connections to unfamiliar IPs, downloads of binaries/scripts, DNS requests for rare domains, or connections to command-and-control infrastructure. Because exploitation may have occurred long before detection, include historical log review around administrative logins, script modifications, unexpected application restarts, and first-seen suspicious files or processes.

• C:\ManageEngine\ADSelfService Plus\logs\
• C:\Program Files\ManageEngine\ADSelfService Plus\logs\
• /opt/ManageEngine/ADSelfServicePlus/logs/
• ADSelfService Plus
• ADSelfServicePlus
• Custom Script
• policy custom script
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• curl http
• wget http
• /bin/sh -c
• /bin/bash -c
• java.exe -> cmd.exe
• java.exe -> powershell.exe
• java -> /bin/sh
• java -> /bin/bash
• nc -e
• netcat -e
• bash -i >& /dev/tcp/
• IEX(New-Object Net.WebClient).DownloadString
• Invoke-WebRequest
• Start-BitsTransfer
• schtasks /create
• New-Service
• sc.exe create
• net user
• net localgroup administrators

What your security team should do

• Immediately inventory all Zoho ManageEngine ADSelfService Plus instances, including internal-only deployments, and identify any build older than 6122.
• Prioritize patching or isolation because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score.
• Remove internet exposure for ADSelfService Plus and restrict administrative access to trusted networks only.
• Reset ADSelfService Plus administrator credentials and verify no default, shared, or weak passwords remain in use.
• Audit configured policy custom scripts for unexpected commands, encoded payloads, download cradles, reverse shell syntax, or recently modified entries.
• Hunt for post-exploitation activity on ADSelfService Plus hosts, especially child processes spawned by Java or the ADSelfService Plus service such as cmd.exe, powershell.exe, sh, bash, curl, wget, certutil, bitsadmin, or nc.
• Review authentication logs for successful logins from unusual source IPs, unexpected administrator accounts, or logins immediately followed by policy/script changes.
• If exploitation is suspected, isolate the host, preserve logs and disk artifacts, rotate credentials that may have been exposed, and investigate Active Directory for lateral movement.