CVE-2021-27956

Vulnerability

Zoho ManageEngine ADSelfService Plus version 6.1 (up to build 6100) contains a stored cross-site scripting (XSS) vulnerability in the /webclient/index.html#/directory-search user search page. The flaw resides in the e-mail address field displayed when clicking the "More" tab on search results [2]. When a user's e-mail field contains HTML or JavaScript payloads, the application renders them unescaped in the browser [2]. Affected versions include builds prior to 6104 [1].

Exploitation

An attacker needs the ability to write to the e-mail attribute of an Active Directory user; this typically requires administrative privileges or delegated write access to directory objects [2]. The attacker inserts a malicious payload, such as ``, into the victim's e-mail field [2]. When any user (including administrators) searches for that directory entry and clicks the "More" tab, the script executes in the context of the viewer's session [2]. No additional user interaction beyond that click is required.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any user who views the search results for the compromised account [2]. This can lead to session cookie theft, redirection to malicious sites, or perform actions on behalf of the victim within the ADSelfService Plus web interface. The impact is at the web application UI layer, with potential privileged access if an administrator views the page.

Mitigation

Zoho released build 6104 on May 8, 2021 to address this vulnerability [2]. Administrators should upgrade to build 6104 or later immediately [1]. No workaround is documented if an upgrade is not possible. The product is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.