CVE-2022-28810

CVE-2022-28810 is an operating system command injection flaw (CWE-78) in the policy custom script feature of Zoho ManageEngine ADSelfService Plus, compounded by use of a default administrator password (CWE-798). A remote authenticated administrator can run arbitrary OS commands through a crafted custom script, and, because the password field is unsanitized, a partially authenticated attacker may also inject commands through it. Successful exploitation executes commands as SYSTEM, giving the attacker full control of the hosting Windows server. Organizations running ADSelfService Plus builds before 6122 are affected. The flaw has public proof-of-concept code and a Metasploit module, a 71% EPSS score, and was added to CISA's Known Exploited Vulnerabilities Catalog on 2023-03-07, indicating active in-the-wild exploitation.

What to do: Upgrade ManageEngine ADSelfService Plus to build 6122 or later per the vendor's instructions; this is a required action for federal agencies under the CISA KEV listing. Until patched, restrict internet exposure of the console and self-service endpoints, replace default administrator credentials, and review configured policy custom scripts and SYSTEM-context process logs for signs of command injection. Given the product's history of APT targeting, hunt for follow-on activity on any host that ran ADSelfService Plus unpatched.