CVE-2022-47966

This PoC exploits CVE-2022-47966, a pre-authentication RCE vulnerability in ManageEngine products using Apache Santuario (xmlsec) <= 1.4.1. It crafts a malicious SAML response with embedded XSLT to execute arbitrary commands via Java's Runtime.exec.

This repository contains a scanner for CVE-2022-47966, a critical unauthenticated remote code execution vulnerability affecting multiple ManageEngine products. The scanner checks for the presence of the vulnerability by analyzing version information and SAML configuration status.

This is a functional exploit for CVE-2022-47966, targeting ManageEngine products via SAML authentication bypass. It crafts a malicious SAML response with embedded XSLT to execute arbitrary commands on vulnerable systems.

This PowerShell script scans ManageEngine ServiceDesk access logs for indicators of CVE-2022-47966 exploitation by detecting and decoding SAML responses containing malicious payloads. It exports findings to a CSV file for further analysis.

The repository provides minimal instructions for testing CVE-2022-47966, a SAML vulnerability, but lacks actual exploit code or payload details. It only describes the request format without technical implementation.

This Metasploit module exploits CVE-2022-47966, an unauthenticated RCE vulnerability in ManageEngine Endpoint Central due to an outdated Apache Santuario library. It leverages a crafted SAML response with XSLT transforms to execute arbitrary Java or Windows commands.

This Metasploit module exploits CVE-2022-47966, an unauthenticated RCE vulnerability in ManageEngine ADSelfService Plus via a crafted SAML response. It leverages an outdated Apache Santuario library to execute arbitrary commands through XSLT transformations.

This Metasploit module exploits CVE-2022-47966, an unauthenticated RCE vulnerability in ManageEngine ServiceDesk Plus due to an outdated Apache Santuario library. It leverages a crafted SAML response to execute arbitrary code via XSLT transforms and Java URLClassLoader.