CVE-2021-31874: 
Zoho ManageEngine ADSelfService Plus vulnerability analysis and mitigation

Zoho ManageEngine ADSelfService Plus before version 6104 contained a vulnerability (CVE-2021-31874) that allowed attackers to obtain sensitive information about the password-sync database application. The vulnerability was discovered in March 2021 and was fixed in build 6104 released in May 2021 (ManageEngine Release, STM Cyber).

The vulnerability exists in the account linking process with external databases. When linking an account, the HOST_NAME parameter, which contains the IP address of the database, could be manipulated. An attacker could specify any IP address, including that of a malicious server with a fake database. This would cause the ADSelfService Plus server to attempt authentication using administrator-stored credentials, thereby exposing them to the attacker. The vulnerability has a CVSS v3.1 score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L (STM Cyber).

The vulnerability allows attackers to retrieve credentials of configured database applications stored by administrators. This could lead to unauthorized access to sensitive database systems and potential compromise of connected infrastructure. The attack requires only low privileges and no user interaction, making it particularly dangerous (STM Cyber).

The vulnerability is confirmed to be exploitable in ADSelfService Plus versions prior to 6104. A proof-of-concept exploit has been publicly released demonstrating the vulnerability using PostgreSQL as an example. The exploit requires only valid user session cookies and can be executed remotely (STM Cyber).

The vulnerability was fixed in ADSelfService Plus build 6104. Organizations should upgrade to this version or later to protect against this vulnerability. The fix prevents the processing of user-provided HOST_NAME parameters and instead uses the administrator-configured value (ManageEngine Release).