CVE-2021-28382

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Zoho ManageEngine Key Manager Plus versions before 6001. The flaw resides in the user-management page (/apiclient/index.jsp#/Settings/UserManagement). When user details are imported from Active Directory (AD), the first name, last name, or email fields are not properly sanitized before being stored. An attacker who controls user attributes in AD can inject malicious HTML or script content that is later reflected without escaping on the affected page [1][2]. All versions prior to build 6001 are vulnerable [2].

Exploitation

To exploit the vulnerability, an attacker must have the ability to modify user attributes in an Active Directory domain that is imported by ManageEngine Key Manager Plus. The attacker inserts a malicious payload, such as ``, into the first name, last name, or email field of an AD user [2]. When an administrator or any user with access to the user-management page loads that page, the injected script executes in the context of the browser session, requiring no additional user interaction beyond page navigation [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking via cookie theft, defacement, or further actions such as phishing or data exfiltration within the application's security context [2]. The scope of compromise is limited to the browser session of the user viewing the user-management page, but may allow the attacker to perform actions on behalf of that user if the application does not enforce additional protections.

Mitigation

The vendor released version 6001 (build 6001) to address this vulnerability. The fixed version is available for download from the ManageEngine Key Manager Plus release notes [1]. Users are strongly advised to upgrade to version 6001 or later immediately [2]. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.