CVE-2022-37024

What it actually does

CVE-2022-37024 is an authenticated SQL injection issue in multiple Zoho ManageEngine products, including OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils. A low-privileged authenticated user can manipulate application requests so that attacker-controlled input is executed as database operations. The vulnerable workflow can be abused to modify database content in a way that ultimately results in remote code execution on the application server. Because the affected products are infrastructure monitoring and network-management platforms, successful exploitation can expose credentials, device inventories, configurations, traffic data, and administrative functions, and can provide a foothold on a highly trusted management host.

Why it matters to the business

Successful exploitation can allow an attacker with any valid application login to take over a ManageEngine server, alter monitoring or network-management data, steal sensitive operational information, and potentially pivot into managed network devices or adjacent systems. The impact is high because these platforms often hold privileged credentials, configuration backups, network topology data, and alerting workflows that security and operations teams rely on. Although this vulnerability is not listed in CISA KEV and no ransomware use is noted, the EPSS score is high, indicating meaningful exploitation likelihood and making timely remediation important for internet-facing or broadly accessible deployments.

How an attack unfolds

An attacker first obtains valid credentials for one of the affected ManageEngine applications, such as through phishing, credential reuse, exposed default accounts, or compromise of a low-privileged user. After authenticating, the attacker sends crafted HTTP requests to vulnerable application functionality that improperly handles input used in database operations. The injected SQL changes database records or application state in a way that enables code execution, such as altering configuration, jobs, scripts, plugin-related data, or other executable application-controlled content. Once code execution is achieved, the attacker can run commands with the privileges of the ManageEngine service account, deploy web shells or other persistence, dump application secrets, access network-device credentials, disable or falsify monitoring, and use the server as a pivot point into the managed environment.

How to fix it

Upgrade the affected Zoho ManageEngine product to a build released on or after the vendor fixes from 2022-07-29 through 2022-07-30. The advisory references fixed builds 125658, 126003, 126105, and 126120; verify the correct target build for the specific product line in Zoho’s release notes or support portal. If immediate upgrade is not possible, restrict access to the ManageEngine web interface to trusted administrative networks or VPNs, remove internet exposure, enforce strong authentication and MFA where supported, disable or remove unused accounts, and limit privileges for non-administrative users. Treat vulnerable instances as high-risk until upgraded, especially where the application stores network-device credentials or has automation privileges. After patching, rotate credentials stored in the platform if exploitation is suspected or logs show suspicious authenticated activity.

How to confirm the fix worked

Confirm the installed product and build number through the ManageEngine administrative console or version files and verify it is at or above the vendor-fixed build for that product. Attempting to validate by exploiting SQL injection is not recommended in production; instead, use vendor-provided build checks, authenticated vulnerability scanners with safe checks, and configuration audits. Confirm that the web interface is not exposed to untrusted networks unless required and protected by compensating controls. Review application health after upgrade, verify that scheduled jobs, integrations, plugins, scripts, and device credentials were not unexpectedly modified, and confirm that only expected administrative accounts remain active. Where possible, run a controlled authenticated scanner or vendor diagnostic tool to confirm the vulnerability is no longer reported.

Typical attack path

1. Identify an exposed or reachable Zoho ManageEngine deployment running an affected product and build level.
2. Obtain valid application credentials for any account with sufficient access to reach the vulnerable functionality.
3. Authenticate to the ManageEngine web interface or API.
4. Submit crafted requests containing malicious SQL input to the vulnerable database-backed workflow.
5. Use the SQL injection to alter database records or application configuration that influence server-side execution.
6. Trigger the modified application state to achieve remote command execution on the ManageEngine server.
7. Establish persistence, collect application secrets and device credentials, and stage tools or web shells.
8. Pivot to managed network devices or internal systems using the trusted position of the management server.

How to detect it

Investigate both application-layer and host-layer evidence. Review ManageEngine access logs, server logs, audit logs, database logs, and reverse-proxy or WAF logs for authenticated requests containing SQL metacharacters, encoded SQL keywords, stacked-query patterns, or requests followed by server errors. Look for bursts of unusual activity from valid accounts, especially low-privileged accounts accessing administrative or configuration-related endpoints. Search application logs for SQL exceptions, syntax errors, database update anomalies, or unexpected changes to jobs, scripts, plugins, reports, credentials, users, roles, or integration settings. On the host, review process creation telemetry for command shells, scripting engines, download tools, archive utilities, or network utilities spawned by Java, the ManageEngine service wrapper, or the application server process. Check for unexpected web-accessible files, recently modified JSP files, suspicious archives, uploaded tools, or new scheduled tasks and services. Review database audit trails, if enabled, for unusual UPDATE, INSERT, or DDL statements performed through the application account. If compromise is suspected, compare application directories and database configuration tables against a known-good backup, collect volatile evidence, rotate stored credentials, and consider rebuilding from trusted media.

• SQL syntax error
• java.sql.SQLException
• com.adventnet.persistence.DataAccessException
• org.postgresql.util.PSQLException
• You have an error in your SQL syntax
• ';--
• ' OR '1'='1
• UNION SELECT
• SLEEP(
• pg_sleep(
• WAITFOR DELAY
• xp_cmdshell
• /bin/sh -c
• /bin/bash -c
• cmd.exe /c
• powershell.exe
• wscript.exe
• cscript.exe
• certutil.exe
• curl.exe
• wget.exe
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• wrapper.exe spawning cmd.exe
• wrapper.exe spawning powershell.exe
• ManageEngine\OpManager\webapps\ROOT\
• ManageEngine\OpManager\working\
• ManageEngine\OpManager\logs\
• ManageEngine\OpManager\bin\
• ManageEngine\OpManager\conf\
• ManageEngine\NetFlow\logs\
• ManageEngine\OpUtils\logs\
• .jsp

What your security team should do

• Prioritize upgrading all affected ManageEngine products to the appropriate fixed build or later, especially internet-facing and centrally managed deployments.
• Inventory all deployments of OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils, including lab and MSP-managed instances.
• Restrict web-console and API access to trusted administrative networks, VPNs, or bastion hosts; remove direct internet exposure where feasible.
• Review all application accounts for unknown, stale, or low-trust users; enforce MFA and least privilege where supported.
• Hunt for suspicious authenticated requests, SQL error messages, unexpected database changes, new scheduled tasks, modified scripts, new plugins, or unexpected files under ManageEngine application directories.
• Rotate application, database, and stored network-device credentials if there is any evidence of compromise.
• Monitor the ManageEngine server for child processes spawned by the application service, such as shell interpreters or scripting engines, because these are strong indicators of post-exploitation activity.
• Preserve logs before patching or rebuilding if compromise is suspected, since attackers may attempt to delete or alter application logs.
• Add SIEM detections for unusual login patterns, suspicious HTTP parameters, SQL error traces, and process execution from the ManageEngine service account.
• Because the EPSS score is high despite the absence of KEV listing, treat remediation as urgent rather than routine.