CVE-2021-40539: 
Zoho ManageEngine ADSelfService Plus vulnerability analysis and mitigation

CVE-2021-40539 is a critical authentication bypass vulnerability affecting Zoho ManageEngine ADSelfService Plus version 6113 and prior. The vulnerability, discovered in September 2021, allows attackers to bypass REST API authentication, potentially leading to remote code execution. The affected software is a self-service password management and single sign-on solution used across various sectors including academic institutions, defense contractors, and critical infrastructure companies (CISA Advisory, NVD).

The vulnerability stems from an error in normalizing URLs before validation in the REST API security filter. Attackers can exploit this by crafting special REST API URLs that bypass the security filter, gaining unauthorized access to REST API endpoints. The vulnerability has received a CVSS v3.1 base score of 9.8 (Critical), indicating its severe nature. The exploitation can lead to arbitrary command execution and allows attackers to place webshells for post-exploitation activities (ManageEngine Advisory).

The successful exploitation of this vulnerability enables attackers to compromise administrator credentials, conduct lateral movement within networks, and exfiltrate registry hives and Active Directory files. The vulnerability affects organizations across 16 critical infrastructure sectors, including academic institutions, defense contractors, and companies in transportation, information technology, manufacturing, communications, and finance sectors (CISA Advisory).

Zoho released a patch for this vulnerability in build 6114 on September 7, 2021. Organizations are strongly advised to update to this version or newer. If compromise is suspected, organizations should disconnect affected systems from the network, back up the ADSelfService Plus database, format compromised machines, and perform a fresh installation. Additionally, organizations should ensure ADSelfService Plus is not directly accessible from the internet and implement domain-wide password resets if any indication of NTDS.dit file compromise is found (ManageEngine Advisory).