^{CVE-2021-37420:}Authentication Bypass in Zoho ManageEngine ADSelfService Plus Allows Mail Spoofing

Overview

ManageEngine ADSelfService Plus is a self-service password management and single sign-on solution for Active Directory and cloud apps. The vulnerability (CVE-2021-37420) affects all versions before 6112 and stems from insufficient authentication controls in the mail handling functionality. An attacker exploiting this vulnerability could bypass authentication mechanisms and send spoofed emails that appear to originate from trusted domains or users within the organization. This could be leveraged for social engineering attacks, where recipients might be more likely to trust and act upon emails they believe come from legitimate internal sources. The vulnerability is particularly concerning because it could be used as part of a larger attack chain to compromise sensitive information or gain unauthorized access to systems.

Remediation

To address this vulnerability, organizations should:

1. Upgrade to ManageEngine ADSelfService Plus version 6112 or later, which contains the security patch that fixes this vulnerability.
2. Apply the hotfix provided by ManageEngine if immediate upgrade is not possible.
3. Implement email authentication protocols such as SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) to help detect and prevent email spoofing.
4. Monitor email logs for suspicious activity that might indicate exploitation attempts.
5. Educate users about email security best practices, including how to identify potentially spoofed emails.
6. Consider implementing additional email security solutions that can detect and block spoofed emails.

References

1. Vendor Security Advisory: https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release
2. Technical Analysis and Exploit Details: https://blog.stmcyber.com/vulns/cve-2021-37420/
3. Vendor Product Information: https://www.manageengine.com
4. CWE-306: Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html