Security advisory - ADSelfService Plus authentication bypass vulnerability

CVE code.: CVE-2021-40539

Severity.: Critical

Versions affected.: ADSelfService Plus builds up to 6113

Fix: ADSelfService Plus build 6114 ( Sep 7, 2021)

This page covers details of the vulnerability and an incident response plan if your system is affected. For more information on the latest updates and the timeline of the vulnerability, you can visit this page. Have questions about this vulnerability? Check out our detailed FAQ page. You can also sign up for a complementary vulnerability audit on this page. Our emergency support team will help you through a one-on-one session and manually run the tool, check for indicators of compromise, and answer all your questions.

We have partnered with Veracode, an independent application security company, to conduct manual pen tests on ADSelfService Plus so that we get a third-person perspective on the security footing of the solution.

Introduction

We were notified about an authentication bypass vulnerability in ADSelfService Plus affecting the REST API URLs that could result in remote code execution.

Details

The Rest API URLs are authenticated by a specific security filter in ADSelfService Plus.

Attackers used specially crafted Rest API URLs that were able to bypass this security filter due to an error in normalizing the URLs before validation. This, in turn, gave attackers access to REST API endpoints, and they exploited the endpoints to perform subsequent attacks such as arbitrary command execution. The following exploit analysis flowchart shows how the attackers exploited the vulnerability.

CVE-2021-40539 exploit analysis flowchart

How do I check if my installation is affected?

There are three ways to check if your installation is affected:

• Run our exploit detection tool.
• Check for specific log entries.
• Check for specific files in your system.

1. Run our exploit detection tool

We have developed an exploit detection tool to help you identify whether your installation has been affected by this vulnerability. You can download the tool here.

Note: A discrepancy was found while running an earlier version of this tool as an administrator. This was reported by Cyberoo CERT and has been fixed as of June 2, 2023.

Once you have downloaded the file, follow these steps:

1. Extract the tool to the \ManageEngine\ADSelfService Plus\bin folder.
2. Right-click on the RCEScan.bat file, and select Run as administrator.
3. A Command Prompt window will open and the tool will run a scan. If your installation is affected, you will get the following message:
   "Result: Your ADSelfService Plus installation is affected by authentication bypass vulnerability."

If you want to check for logs manually, you can follow the steps given below.

2. Check for specific log entries

1. Access logs

   In the \ManageEngine\ADSelfService Plus\logs folder, search the access log files with the pattern "access_log_<date>.txt" and check for entries with the strings listed below:

   1. /../RestAPI
   2. /./RestAPI

   The image below shows an access log entry example with the above mentioned strings:

   

2. ServerOut logs

   In the \ManageEngine\ADSelfService Plus\logs folder, search the access log files with the pattern "serverOut_<date>.txt" and check for an exception as shown in the image below:

   

3. ADS logs

   In the \ManageEngine\ADSelfService Plus\logs folder, search the access log files with the pattern "adslog_<date>.txt" and check for Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig as shown in the image below:

   

3. Check for specific files in the system

If you are running ADSelfService Plus version 6113 or lower, and if your system has been affected, your system may have the following files in the ADSelfService Plus installation folder:

1. service.cer in the \ManageEngine\ADSelfService Plus\bin folder.
2. ReportGenerate.jsp in the \ManageEngine\ADSelfService Plus\help\admin-guide\Reports and \ManageEngine\ADSelfService Plus\webapps\adssp\help\admin-guide\reports folders.
3. adap.jsp in the \ManageEngine\ADSelfService Plus\webapps\adssp\help\html\promotion folder.
4. custom.bat and custom.txt files in the C:\Users\Public\ folder.

Additionally, the below IoCs were published by CrowdStrike on Jun 22, 2023, in connection to their observation of a threat activity suspected to be exploiting CVE-2021-40539.

5. selfsdp.jspx in \ManageEngine\ADSelfService Plus\webapps\adssp\html\promotion\ folder.
6. error.jsp in \ManageEngine\ADSelfService Plus\webapps\adssp\html\ folder.
7. tomcat-ant.jar in \ManageEngine\ADSelfService Plus\lib\ folder.
8. Any folder other than selfservice in \ManageEngine\ADSelfService Plus\work\Catalina\localhost\ROOT\org\apache\jsp\ folder.

Incident response plan