CVE-2023-29084

What it actually does

Zoho ManageEngine ADManager Plus versions before 7181 contain an authenticated command injection flaw in the Proxy settings functionality. A user with high privileges can supply crafted proxy configuration input that is incorporated into an operating-system command without sufficient neutralization, allowing arbitrary command execution on the ADManager Plus server. Because the application commonly runs with significant local privileges and integrates with Active Directory, successful exploitation can compromise confidentiality, integrity, and availability of the application host and potentially expose connected directory-management capabilities.

Why it matters to the business

Compromise of an ADManager Plus server can disrupt identity administration, expose sensitive directory and user-management data, and provide an attacker a foothold in a highly privileged administrative platform. Although exploitation requires authenticated high-privilege access, the exploit is considered weaponized and the EPSS score is extremely high, indicating elevated likelihood of exploitation in exposed or reachable deployments. A successful attack could lead to unauthorized directory changes, credential theft, lateral movement, service outages, and incident-response costs.

How an attack unfolds

An attacker first obtains valid high-privilege credentials for Zoho ManageEngine ADManager Plus through phishing, credential reuse, prior compromise, or abuse of an existing administrator account. After authenticating to the web interface, the attacker navigates to the Proxy settings area and submits malicious proxy configuration data containing operating-system command syntax. The vulnerable server-side code passes that input into a command execution context without proper sanitization, causing the injected command to run on the ADManager Plus host. The attacker can then execute reconnaissance commands, drop tooling, create persistence, access application configuration and logs, harvest credentials or tokens available to the service, and use the server’s directory-management role to expand access within the environment.

How to fix it

Upgrade Zoho ManageEngine ADManager Plus to version 7181 or later. If a newer vendor-supported build is available, upgrade to the latest stable release rather than only the minimum fixed version. Until upgraded, restrict access to the ADManager Plus web interface to trusted administrative networks or VPNs, enforce strong MFA for administrative users, review and reduce privileged ADManager Plus roles, and block unnecessary outbound access from the application server. Rotate credentials and secrets accessible to ADManager Plus if exploitation is suspected. Review vendor hardening guidance for service-account permissions, application logging, and secure administrative exposure.

How to confirm the fix worked

Confirm the installed ADManager Plus build is 7181 or later from the product UI, installation metadata, or vendor-supported version command/file. Verify the Proxy settings page accepts only valid proxy values and does not execute metacharacters or command separators in controlled testing. Confirm the ADManager Plus web interface is not broadly exposed to the internet and is limited to approved administrative sources. Review access-control configuration to ensure only authorized administrators can change proxy settings. If the system was upgraded, verify the service restarted cleanly, no unauthorized proxy configuration remains, and application functionality is intact.

Typical attack path

1. Obtain valid high-privilege ADManager Plus credentials or compromise an existing privileged session.
2. Access the ADManager Plus web interface over the network.
3. Open or invoke the Proxy settings functionality.
4. Submit crafted proxy-setting values containing command-injection payloads.
5. Execute arbitrary commands on the ADManager Plus server under the application/service account context.
6. Run host and domain reconnaissance commands to identify privileges and reachable systems.
7. Deploy web shells, remote access tools, scheduled tasks, or other persistence mechanisms.
8. Harvest credentials, application secrets, logs, configuration files, or directory data.
9. Abuse ADManager Plus integrations and host access for lateral movement or further directory compromise.

How to detect it

Look for evidence of suspicious administrative activity followed by operating-system command execution on the ADManager Plus server. Review ADManager Plus application and access logs for logins by privileged users, changes to Proxy settings, unusual POST requests to configuration endpoints, and proxy values containing shell metacharacters such as semicolons, pipes, backticks, dollar-parentheses, ampersands, or encoded equivalents. Correlate these events with endpoint telemetry showing Java or the ADManager Plus service spawning command shells, scripting engines, download utilities, archive tools, or persistence mechanisms. On Windows hosts, review Security logs, Sysmon, PowerShell logs, scheduled task logs, service creation events, and EDR process trees for suspicious child processes from java.exe or the ADManager Plus service wrapper. On Linux hosts, review shell history, auditd, system logs, web/application logs, cron entries, and process execution records for commands run by the ADManager Plus service account. Investigate unexpected outbound connections from the ADManager Plus server, newly written executables or scripts in application, temporary, or web-accessible directories, unauthorized proxy configuration changes, and unusual directory-management actions performed after a proxy settings update.

• ADManager Plus Proxy settings change followed by child process execution from java.exe
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java.exe spawning pwsh.exe
• java.exe spawning wscript.exe
• java.exe spawning cscript.exe
• java.exe spawning certutil.exe
• java.exe spawning bitsadmin.exe
• java.exe spawning curl.exe
• java.exe spawning wget.exe
• java.exe spawning whoami.exe
• java.exe spawning net.exe
• java.exe spawning nltest.exe
• java.exe spawning dsquery.exe
• java.exe spawning schtasks.exe
• java.exe spawning reg.exe
• java.exe spawning rundll32.exe
• java.exe spawning mshta.exe
• cmd.exe /c
• powershell -enc
• powershell -EncodedCommand
• /bin/sh -c
• /bin/bash -c
• proxy settings
• Proxy settings
• proxyHost
• proxyPort
• ;whoami
• |whoami
• `whoami`
• $(whoami)
• %3bwhoami
• %7cwhoami
• ManageEngine ADManager Plus

What your security team should do

• Prioritize upgrade to ADManager Plus 7181 or later, preferably the latest supported release, because exploit maturity is weaponized and EPSS is extremely high.
• Audit ADManager Plus administrative users and remove unnecessary high-privilege access.
• Require MFA and strong session controls for all privileged ADManager Plus accounts.
• Restrict network access to the ADManager Plus web interface to trusted administrative networks only.
• Review Proxy settings change history, administrative login activity, and server process-execution logs for suspicious activity before and after patching.
• Hunt for unexpected child processes spawned by the ADManager Plus or Java service process, especially shell interpreters and network utilities.
• Rotate ADManager Plus service-account credentials, directory bind credentials, API keys, and locally stored secrets if compromise cannot be ruled out.
• Monitor for unauthorized Active Directory changes originating from ADManager Plus service accounts or the ADManager Plus server.
• Ensure endpoint detection, command-line logging, and centralized log retention are enabled on the ADManager Plus host.