Emergency assistance for ADSelfService Plus vulnerability (CVE-2021-40539)
Vulnerability fixed. Update to ADSelfService Plus build 6114 or above immediately.
An authentication bypass vulnerability (CVE-2021-40539) that affects the REST API URLs that could result in remote code execution (RCE) was identified in ADSelfService Plus, ManageEngine's self-service password management, and single sign-on solution. ManageEngine rates this vulnerability affecting ADSelfService Plus builds 6113 and below as critical, and has noticed indications of exploitation by cyber actors. Instances of this vulnerability were first detected in August 2021, when malicious actors tried gaining access to ADSelfService Plus by exploiting CVE-2021-40539. This vulnerability allows malicious cyber actors to place webshells and conduct post-exploitation activities such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files. This was addressed by releasing the fix in build 6114.
In a security advisory ManageEngine released consecutively, it strongly urges users and administrators to update to ADSelfService Plus build 6114 or above. Referencing ManageEngine's advisory, the Federal Bureau of Investigation (FBI), United States Coast Guard Cyber Command (CGCYBER), and the Cybersecurity Infrastructure and Security Agency (CISA) in their join advisory have also recommended users to update to ADSelfService Plus build 6114 or above.
We have partnered with Veracode, an independent application security company, to conduct manual pen tests on ADSelfService Plus so that we get a third-person perspective on the security footing of the solution.
Released on September 6, 2021, fixes CVE-2021-40539. ManageEngine strongly urges users and administrators to update to ADSelfService Plus build 6114 or above.
Watch how to detect and mitigate any compromises in your installation.
CVE-2021-40539 is an authentication bypass vulnerability concerning the REST API URLs in ADSelfService Plus. This is a critical issue and can allow attackers to gain unauthorized access to the product through REST API endpoints by sending a specially crafted request. This would allow the attacker to carry out subsequent attacks and perform RCE.
ADSelfService Plus builds up to 6113 are vulnerable.
We have developed a remediation tool to help you identify whether your installation has been affected by this vulnerability. You can download the tool here. Once you have downloaded, follow these steps:
(or) To manually identify if your installation is affected, follow these steps:
a. access log
\ManageEngine\ADSelfService Plus\logs folder, search the access log files of pattern '"access_log_<date>.txt" and check for entries with the strings listed below:
The image below shows such an access log entry:
b. ServerOut log
In \ManageEngine\ADSelfService Plus\logs folder, search the access log files of pattern '"serverOut_<date>.txt" and check for an exception as shown in the image below:
c. ADS log
In \ManageEngine\ADSelfService Plus\logs folder, search the access log files of pattern '"adslog_<date>.txt" and check for an exception as shown in the image below:
Affected systems may have the following files in the ADSelfService Plus installation folder if you are running versions 6113 or lower:
Additionally, the below IoCs were published by CrowdStrike on Jun 22, 2023, in connection to their observation of a threat activity suspected to be exploiting CVE-2021-40539.
Implement the remediation steps provided below at the earliest.
Even if your installation is not affected by the vulnerability, we suggest you update to ADSelfService Plus build 6114 using the service pack.
Follow the below steps to update ADSelfService Plus to build 6114:
To find your current build number, log in to the ADSelfService Plus web client, and click the "License" link in the top pane. You'll find the build number in the License Details popup.
Currently, there are no workarounds to address this vulnerability. The threat posed by the vulnerability is critical. Therefore, we strongly recommend you update ADSelfService Plus to the latest build as soon as possible.
The new ADSelfService Plus build 6114 released on 7th September 2021 fixes the authentication bypass vulnerability.
You can use our exploit detection tool to check if your installation has been affected by this vulnerability. We've also put together an incident response plan to help you immediately address this vulnerability.
For any immediate support regarding this issue, customers can get in touch with us at adselfserviceplus-security@manageengine.com or +1-408-916-9890 (toll free).
To bolster the security of ADSelfService Plus further, our engineering and security teams are taking measures to improve the security of the product.
To ensure that ADSelfService Plus remains secure, we have teamed up with Veracode, an independent application security company, to conduct manual pen tests on ADSelfService Plus. You can learn more about how ManageEngine prevents vulnerabilities in ADSelfService Plus during its development process.
We've put together a dedicated webpage to keep you up to date on the latest updates from our side, technicalities of the vulnerability, our incident response plan, and recommended actions. Read our security advisory for more info.