CVE-2023-28342

What it actually does

CVE-2023-28342 is an unauthenticated, network-reachable denial-of-service vulnerability in Zoho ManageEngine ADSelfService Plus versions before build 6218. The flaw is exposed through the Mobile App Authentication API and can be triggered without credentials or user interaction. Successful exploitation can exhaust or crash application resources, making ADSelfService Plus unavailable and disrupting self-service password reset, account unlock, and authentication-related workflows. The CVSS vector indicates no confidentiality or integrity impact, but high availability impact.

Why it matters to the business

Exploitation can interrupt identity self-service operations, causing users to be unable to reset passwords, unlock accounts, or use ADSelfService Plus-dependent workflows. In large organizations, this can increase help desk load, delay employee access, and create operational disruption during business-critical periods. Although this vulnerability is not currently listed in CISA KEV and is not flagged as ransomware-associated, its high EPSS score indicates meaningful exploitation likelihood, and the issue has been public for a long time, increasing the chance that exposed legacy deployments are targeted opportunistically.

How an attack unfolds

An attacker first identifies an internet-accessible or internally reachable Zoho ManageEngine ADSelfService Plus instance running a vulnerable build before 6218. Because the vulnerable Mobile App Authentication API does not require authentication to reach the affected code path, the attacker sends crafted or excessive requests to that API. The vulnerable service mishandles the requests in a way that degrades availability, potentially exhausting resources, causing service instability, or making the application unavailable. The attacker does not need a valid account, privileged access, or user interaction. The result is disruption of ADSelfService Plus functionality until the service recovers, is restarted, traffic is blocked, or the software is upgraded.

How to fix it

Upgrade Zoho ManageEngine ADSelfService Plus to build 6218 or later. If immediate upgrade is not possible, reduce exposure by restricting access to ADSelfService Plus to trusted networks, VPNs, or identity infrastructure segments; block direct internet access to the application; apply web application firewall or reverse-proxy rate limiting to authentication and mobile API paths; and monitor for abnormal request volume against mobile authentication endpoints. Restarting the service may restore availability temporarily but does not remediate the vulnerability.

How to confirm the fix worked

Confirm the deployed ADSelfService Plus build is 6218 or later using the product administration console, version file, or vendor-supported inventory method. Verify that externally reachable instances are not running vulnerable builds by checking exposed service banners only where appropriate and validating through authenticated administrative review. Confirm compensating controls by testing that untrusted networks cannot reach ADSelfService Plus and that rate limiting or access controls apply to mobile authentication API traffic. Review application and reverse-proxy logs after patching to ensure requests to the affected API no longer cause service errors, crashes, or sustained resource exhaustion.

Typical attack path

1. Discover an exposed Zoho ManageEngine ADSelfService Plus web interface.
2. Determine or assume the target is running a build earlier than 6218.
3. Send unauthenticated requests to the Mobile App Authentication API designed to trigger the denial-of-service condition.
4. Repeat or sustain requests to keep the service unstable or unavailable.
5. Monitor the target for degraded response times, HTTP 5xx errors, connection resets, or complete service outage.

How to detect it

To determine whether exploitation may have occurred, review ADSelfService Plus application logs, web access logs, reverse-proxy logs, WAF logs, load balancer telemetry, system event logs, and service monitoring data. Look for sudden bursts of unauthenticated requests to mobile authentication functionality, repeated requests from the same source or distributed sources, elevated HTTP 500/502/503/504 responses, abrupt increases in response time, Java process crashes, high CPU or memory consumption, service restarts, or periods where ADSelfService Plus became unavailable. Correlate suspicious traffic with outage windows, help desk reports about failed password resets or account unlocks, and host-level evidence such as application service restarts or out-of-memory conditions. Because this is a denial-of-service issue, durable host artifacts may be limited; the most useful evidence is usually traffic volume, request pattern anomalies, and availability telemetry around the time of disruption.

What your security team should do

• Prioritize upgrading all Zoho ManageEngine ADSelfService Plus deployments to build 6218 or later, especially internet-facing instances.
• Inventory all ADSelfService Plus systems, including internal-only deployments, because the flaw is unauthenticated and can be exploited by any network-reachable attacker.
• Restrict ADSelfService Plus access to trusted networks or VPN paths and remove unnecessary public exposure.
• Apply rate limiting and anomaly detection for authentication and mobile API endpoints at the reverse proxy, load balancer, or WAF layer.
• Review historical web, reverse-proxy, WAF, and application logs for spikes in unauthenticated requests to mobile authentication functionality, HTTP 5xx responses, service restarts, or outages.
• Create operational runbooks for rapid service restart and traffic blocking if denial-of-service activity is observed.
• Track vendor advisories for ManageEngine ADSelfService Plus and include this product in routine vulnerability and external attack surface management scans.