Description
ZOHO ManageEngine ADSelfService Plus是美国卓豪（ZOHO）公司的针对 Active Directory 和云应用程序的集成式自助密码管理和单点登录解决方案。
Zoho ManageEngine ADSelfService Plus 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/82421acc-cfbc-42e3-97c1-8eb285e6eda8
https://nosec.org/m/share/4857.html
https://github.com/lpyydxs/CVE-2021-40539
https://zone.ci/aliyun/ali_nvd/86059.html
https://vvmdx.github.io/2022/03/12/2022-03-12-Zoho%20ManageEngine%20ADSelfService%20Plus%20%E4%BB%8E%E8%BA%AB%E4%BB%BD%E9%AA%8C%E8%AF%81%E7%BB%95%E8%BF%87%E5%88%B0RCE(cve-2021-40539)/index.html
https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
https://nvd.nist.gov/vuln/detail/CVE-2021-40539
https://pentest-tools.com/blog/detect-zoho-rce-cve-2021-40539
https://www.rapid7.com/db/modules/exploit/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966/