CVE-2022-42904

What it actually does

CVE-2022-42904 is an authenticated command injection vulnerability in Zoho ManageEngine ADManager Plus through version 7151. An attacker with administrative access to the ADManager Plus web interface can abuse the proxy settings functionality to cause the server to execute operating system commands. Because ADManager Plus commonly runs with privileges sufficient to manage Active Directory-related workflows, successful exploitation can result in full compromise of the application server, including command execution, data access, configuration tampering, and service disruption.

Why it matters to the business

If an ADManager Plus administrator account is compromised or misused, this flaw can turn that access into direct control of the underlying server. The operational risk is significant because ADManager Plus is often connected to identity-management processes and directory infrastructure; compromise may expose user, group, and administrative data, enable unauthorized changes, interrupt identity operations, or provide a foothold for broader domain-focused attacks. The high EPSS score indicates a relatively elevated likelihood of exploitation activity compared with many vulnerabilities, even though it is not currently listed in CISA KEV and no ransomware association is specified.

How an attack unfolds

An attacker first obtains valid administrative credentials for ADManager Plus through phishing, credential theft, password reuse, session theft, or misuse of an existing privileged account. After logging in to the web console, the attacker navigates to the proxy settings feature and submits crafted input containing shell metacharacters or command payloads in a field that is later passed to the operating system. When the application processes or validates the proxy configuration, the injected command executes on the ADManager Plus host in the security context of the application service. The attacker can then run reconnaissance commands, write web-accessible files, add persistence, dump configuration or credential material, modify application settings, pivot toward connected directory services, or disrupt the service.

How to fix it

Upgrade Zoho ManageEngine ADManager Plus to a version later than 7151 that contains the vendor fix. If an exact fixed version is not available in internal vulnerability data, consult Zoho ManageEngine advisories and release notes and deploy the latest supported ADManager Plus build. Until upgraded, restrict access to the ADManager Plus administrative interface to trusted management networks, enforce multifactor authentication for administrators, reduce the number of admin users, review and harden proxy settings, and monitor or disable unnecessary outbound connectivity from the ADManager Plus server. Treat any unexplained proxy configuration change on an affected version as suspicious.

How to confirm the fix worked

Confirm the installed ADManager Plus build is greater than 7151 or matches the vendor-documented fixed release. Verify that the administrative web interface is not exposed to untrusted networks and that only authorized administrators can access proxy configuration functions. Review current proxy settings for unexpected values, shell metacharacters, encoded payloads, external callback domains, or recently modified configuration entries. Where safe and authorized, perform a controlled negative test by submitting benign special characters to proxy fields and confirming they are rejected or safely handled without command execution. Validate that application service accounts run with least privilege and that EDR or host telemetry would alert on unexpected child processes spawned by the ADManager Plus service.

Typical attack path

1. Acquire or reuse valid ADManager Plus administrative credentials.
2. Authenticate to the ADManager Plus web management interface.
3. Access the proxy settings configuration page or related administrative endpoint.
4. Submit a malicious proxy configuration value containing operating system command syntax.
5. Trigger the application workflow that processes the proxy setting and invokes the underlying command.
6. Execute reconnaissance commands on the ADManager Plus server to identify OS, privileges, network access, and stored credentials.
7. Deploy persistence, exfiltrate sensitive application or directory-management data, modify identity-management workflows, or pivot to adjacent systems.

How to detect it

Look for signs that ADManager Plus proxy settings were modified by an administrator shortly before suspicious operating system activity. Useful log sources include ADManager Plus application and audit logs, web access logs for administrative configuration endpoints, Windows Security logs, Sysmon or EDR process telemetry, PowerShell logs, Linux shell/process logs where applicable, and firewall/proxy/DNS logs for outbound connections from the ADManager Plus server. Investigate any instance where the ADManager Plus service process, commonly a Java process, spawns command shells or utilities such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, curl, wget, bash, sh, nc, or python. Also review for suspicious proxy values containing command separators such as ;, &&, |, backticks, $(), URL-encoded metacharacters, or outbound callback domains. Because exploitation requires administrator authentication, correlate suspicious configuration changes with admin login source IPs, unusual login times, new admin accounts, MFA failures, and session anomalies.

• ADManager Plus proxy settings changed
• proxy settings
• cmd.exe /c
• powershell.exe -enc
• powershell -encodedcommand
• /bin/sh -c
• /bin/bash -c
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java spawning /bin/sh
• certutil.exe -urlcache
• bitsadmin /transfer
• curl http://
• wget http://
• nc -e
• ncat -e
• ; whoami
• && whoami
• | whoami
• `whoami`
• $(whoami)
• ; id
• && id
• | id
• `id`
• $(id)
• Process Name: cmd.exe
• Process Name: powershell.exe
• ParentImage:*java.exe
• ParentCommandLine:*ADManager*

What your security team should do

• Prioritize upgrading ADManager Plus deployments through version 7151 to the latest supported fixed build because the vulnerability can lead to full server compromise after admin authentication.
• Immediately audit ADManager Plus administrator accounts for unauthorized users, weak passwords, missing MFA, stale accounts, and recent suspicious logins.
• Restrict ADManager Plus web console access to VPN, bastion hosts, or dedicated management networks; do not expose it directly to the internet.
• Review proxy settings and recent configuration changes for command separators, encoded commands, unusual domains, or unexpected outbound destinations.
• Hunt for evidence of exploitation using application logs, web access logs, operating system process creation telemetry, EDR alerts, and outbound network logs from the ADManager Plus server.
• Alert on unexpected operating system commands spawned by Java or the ADManager Plus service process, especially shells, scripting engines, download utilities, and directory-reconnaissance tools.
• Rotate credentials and review directory-management permissions if exploitation is suspected, because ADManager Plus may store or access sensitive identity-management credentials.
• Implement egress filtering from the ADManager Plus server to reduce the impact of command execution and detect callback attempts.