Zoho Releases Security Update for ADSelfService Plus

ronjor · Sep 8, 2021

Original release date: September 07, 2021 | Last revised: September 08, 2021

Zoho has released a security update on a vulnerability (CVE-2021-40539) affecting ManageEngine ADSelfService Plus builds 6113 and below. CVE-2021-40539 has been detected in exploits in the wild.
Click to expand...

A remote attacker could exploit this vulnerability to take control of an affected system. ManageEngine ADSelfService Plus is a self-service password management and single sign-on solution for Active Directory and cloud apps. Additionally, CISA strongly urges organizations ensure ADSelfService Plus is not directly accessible from the internet.
Click to expand...

CISA encourages users and administrators to review the Zoho advisory for more information and to update to ADSelfService Plus build 6114.
Click to expand...

guest · Sep 16, 2021

FBI-CISA-CGCYBER Advisory on APT Exploitation of ManageEngine ADSelfService Plus Vulnerability
September 16, 2021
https://us-cert.cisa.gov/ncas/curre...gcyber-advisory-apt-exploitation-manageengine

The Federal Bureau of Investigation (FBI), CISA, and Coast Guard Cyber Command (CGCYBER) have released a Joint Cybersecurity Advisory (CSA) detailing the active exploitation of an authentication bypass vulnerability (CVE-2021-40539) in Zoho ManageEngine ADSelfService Plus—a self-service password management and single sign-on solution. The FBI, CISA, and CGCYBER assess that advanced persistent threat (APT) cyber actors are likely among those exploiting the vulnerability. The exploitation of this vulnerability poses a serious risk to critical infrastructure companies, U.S.-cleared defense contractors, academic institutions, and other entities that use the software.
Click to expand...

CISA strongly encourages users and administrators to review Joint FBI-CISA-CGCYBER CSA: APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus and immediately implement the recommended mitigations, which include updating to ManageEngine ADSelfService Plus build 6114.
Click to expand...

guest · Sep 24, 2021

State-sponsored hacking group targets Port of Houston using Zoho zero-day
September 23, 2021
https://therecord.media/state-sponsored-hacking-group-targets-port-of-houston-using-zoho-zero-day/

A suspected state-sponsored hacking group has attempted to breach the network of the Port of Houston, one of the largest port authorities in the US, using a zero-day vulnerability in a Zoho user authentication appliance, CISA officials said in a Senate hearing today.

Port officials said they successfully defended the attack, and “no operational data or systems were impacted as a result” of the attempted intrusion.
The investigation into the attack resulted in CISA, the FBI, and the Coast Guard sending a joint advisory on September 16 warning US organizations about attacks carried out by a nation-state hacking group using the Zoho zero-day.
Click to expand...

Zoho patched the vulnerability (CVE-2021-40539) on September 8, when CISA also issued a first warning of the ongoing attacks.
The attack has not yet been attributed to a specific foreign government
CISA officials said they have not yet attributed the attack against the Port of Houston to a specific hacking group or foreign government.

“[A]ttribution can always be complicated in terms of being able to dispositively say who that threat actor is,” CISA Director Jen Easterly told senators today in a meeting of the Senate Homeland Security and Governmental Affairs Committee.
Click to expand...

guest · Nov 8, 2021

Nation-state actors target critical sectors by exploiting the CVE-2021-40539 flaw
November 8, 2021
https://securityaffairs.co/wordpres...e-actors-critical-sectors-cve-2021-40539.html

Cybersecurity experts from Palo Alto Networks warn of an ongoing cyberespionage campaign that has already compromised at least nine organizations worldwide from critical sectors, including defense, healthcare, and energy.

Threat actors exploited a critical vulnerability, tracked as CVE-2021-40539, in the Zoho ManageEngine ADSelfService Plus software, which is self-service password management and single sign-on solution. The vulnerability resides in the REST API URLs in ADSelfService Plus and could lead to remote code execution (RCE).
In the middle of September, the FBI, CISA, and the Coast Guard Cyber Command (CGCYBER) warned that nation-state APT groups were actively exploiting the CVE-2021-40539 flaw.
Click to expand...

Experts also observed a series of unrelated attacks that failed to compromise their targets, these attacks have been attributed to separated threat actors.

“As early as Sept. 17 the actor leveraged leased infrastructure in the United States to scan hundreds of vulnerable organizations across the internet. Subsequently, exploitation attempts began on Sept. 22 and likely continued into early October. During that window, the actor successfully compromised at least nine global entities across the technology, defense, healthcare, energy and education industries.” reads the analysis published by Palo Alto Networks.
Click to expand...

ronjor · Nov 9, 2021

Security Researchers Reveal Activity Targeting ManageEngine ADSelfService Plus

Original release date: November 09, 2021
On September 16, CISA released a joint alert on exploitation of a vulnerability (CVE-2021-40539) in ManageEngine ADSelfService Plus. On November 8, security researchers from Palo Alto Networks and Microsoft Threat Intelligence Center (MSTIC) released separate reports on targeted attacks against ManageEngine ADSelfService Plus.
Click to expand...

CISA encourages organizations to review the indicators of compromise and other technical details in the following reports to uncover any malicious activity within their networks.
Click to expand...

Palo Alto Networks: Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer
MSTIC: Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus
Click to expand...

ronjor · Nov 19, 2021

Updated: APT Exploitation of ManageEngine ADSelfService Plus Vulnerability

Original release date: November 19, 2021
The Federal Bureau of Investigation (FBI), CISA, and Coast Guard Cyber Command (CGCYBER) have updated the Joint Cybersecurity Advisory (CSA) published on September 16, 2021, which details the active exploitation of an authentication bypass vulnerability (CVE-2021-40539) in Zoho ManageEngine ADSelfService Plus—a self-service password management and single sign-on solution.
Click to expand...

CISA encourages organizations to review the update the November 19 update and apply the recommended mitigations. CISA also recommends reviewing the relevant blog posts from Palo Alto Networks, Microsoft, and IBM Security Intelligence.
Click to expand...

ronjor · Dec 2, 2021

CISA and FBI Release Alert on Active Exploitation of CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus

Original release date: December 02, 2021
CISA and the Federal Bureau of Investigation (FBI) have released a joint Cybersecurity Advisory identifying active exploitation of a vulnerability—CVE-2021-44077—in Zoho ManageEngine ServiceDesk Plus. CVE-2021-44077 is an unauthenticated remote code execution vulnerability that affects all ServiceDesk Plus versions up to, and including, version 11305.
Click to expand...

This vulnerability was addressed by the update released by Zoho on September 16, 2021 for ServiceDesk Plus versions 11306 and above. If left unpatched, successful exploitation of the vulnerability allows an attacker to upload executable files and place webshells that enable post-exploitation activities, such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files. Zoho has set up a security response plan center that provides additional details, a downloadable tool that can be run on potentially affected systems, and a remediation guide.
Click to expand...

CISA encourages organizations to review the joint Cybersecurity Advisory and apply the recommended mitigations immediately.
Click to expand...

guest · Dec 6, 2021

Hackers use in-house Zoho ServiceDesk exploit to drop webshells
December 2, 2021

An advanced persistent threat (APT) group that had been exploiting a flaw in the Zoho ManageEngine ADSelfService Plus software has pivoted to leveraging a different vulnerability in another Zoho product.

The actor has been seen exploiting an unauthenticated remote code execution issue in Zoho ServiceDesk Plus versions 11305 and older, currently tracked as CVE-2021-44077.
According to a report from Palo Alto Networks’ Unit42, there is no public proof-of-concept exploit for CVE-2021-44077, which suggests that the APT group leveraging it developed the exploit code itself and are using it exclusively for now.
Click to expand...

According to the researchers, the actor used the same webshell secret key seen in the ADSelfService Plus campaign, but this time it installs as an Apache Tomcat Java Servlet Filter.

“The fact that this Godzilla webshell is installed as a filter means that there is no specific URL that the actor will send their requests to when interacting with the webshell and the Godzilla webshell filter can also bypass a security filter that is present in ServiceDesk Plus to stop access to webshell files” – reads Unit42’s analysis
Click to expand...

ronjor · Dec 6, 2021

Zoho Releases Security Advisory for ManageEngine Desktop Central and Desktop Central MSP

Original release date: December 06, 2021
Zoho has released a security advisory to address an authentication bypass vulnerability in ManageEngine Desktop Central and Desktop Central MSP. An attacker could exploit this vulnerability to take control of an affected system. According to Zoho, this vulnerability is being actively exploited in the wild.
Click to expand...

CISA encourages users and administrators to review the Zoho Vulnerability Notification
and the Zoho ManageEngine Desktop Central and ManageEngine Desktop Central MSP security advisories and apply the recommended mitigations immediately.
Click to expand...

guest · Dec 20, 2021

FBI: State hackers exploiting new Zoho zero-day since October
December 20, 2021

The Federal Bureau of Investigation (FBI) says a zero-day vulnerability in Zoho's ManageEngine Desktop Central has been under active exploitation by state-backed hacking groups (also known as APTs or advanced persistent threats) since at least October.

"Since at least late October 2021, APT actors have been actively exploiting a zero-day, now identified as CVE-2021-44515, on ManageEngine Desktop Central servers," the FBI's Cyber Division said [PDF].
"The APT actors were observed compromising Desktop Central servers, dropping a webshell that overrides a legitimate function of Desktop Central, downloading post-exploitation tools, enumerating domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials."
Click to expand...

CISA added CVE-2021-44515 to its Known Exploited Vulnerabilities Catalog on December 10, requiring federal agencies to patch it before Christmas under Binding Operational Directive (BOD) 22-01.
Click to expand...

Log in or Sign up

Zoho Releases Security Update for ADSelfService Plus

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

Log in or Sign up

Zoho Releases Security Update for ADSelfService Plus

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

ronjor Global Moderator

guest Guest

Useful Searches