CVE-2021-40539
CRITICAL KEV RANSOMWARE NUCLEIManageEngine ADSelfService Plus CVE-2021-40539
Title source: metasploitExploitation Summary
CVE-2021-40539 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns.
EIP tracks 6 public exploits from researchers including synacktiv, Bu0uCat, DarkSprings, including a Metasploit module exploits/windows/http/manageengine_adselfservice_plus_cve_2021_40539.
A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits CVE-2021-40539, an authentication bypass and RCE vulnerability in ManageEngine ADSelfService Plus. It uploads a JSP webshell and a malicious Java class file, then triggers RCE via a crafted request to the RestAPI endpoint.
Description
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Exploits (6)
This PoC exploits CVE-2021-40539, an authentication bypass and RCE vulnerability in ManageEngine ADSelfService Plus. It uploads a JSP webshell and a malicious Java class file, then triggers RCE via a crafted request to the RestAPI endpoint.
This repository contains a Python-based exploit for CVE-2021-40539, an RCE vulnerability in ZOHO ManageEngine ADSelfService Plus. The exploit uploads a JSP webshell and a Java class file to achieve remote code execution via a directory traversal and file upload vulnerability.
The repository contains only a README.md file with minimal information about CVE-2021-40539, lacking any exploit code or technical details. No functional PoC or exploit logic is present.
This repository contains a Python-based exploit for CVE-2021-40539, an authentication bypass vulnerability in Zoho ManageEngine ADSelfService Plus. The exploit uploads a JSP webshell and a Java class file to achieve remote code execution (RCE) on vulnerable systems.
This repository contains a Python-based exploit for CVE-2021-40539, an authentication bypass vulnerability in Zoho ManageEngine ADSelfService Plus. The exploit includes functionality to upload a JSP webshell and a Java class payload, then trigger remote code execution via the REST API.
This Metasploit module exploits CVE-2021-40539, an authentication bypass in ManageEngine ADSelfService Plus, to upload and execute a malicious JAR file, achieving remote code execution as the SYSTEM user if the service runs with elevated privileges.
Nuclei Templates (1)
http.title:"manageengine" || http.title:"adselfservice plus"
title="manageengine" || title="adselfservice plus"
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H