CVE-2021-35512

Vulnerability

An SSRF vulnerability exists in Zoho ManageEngine Applications Manager builds 15190 and 15200. The vulnerable component allows an attacker to send crafted requests that are executed by the server, reaching internal resources [2].

Exploitation

An attacker can exploit this by supplying a malicious URL to the vulnerable endpoint. No authentication is required, and the server-side code will process the URL, allowing the attacker to scan ports, fingerprint the intranet, and access internal services [2].

Impact

Successful exploitation can lead to port scanning, fingerprinting of the internal network, attacking internal web applications, and reading local web server files, potentially exposing sensitive information [2].

Mitigation

Zoho has released fixes in later builds. Users should upgrade to the latest version of Applications Manager. For details, refer to the release notes [3]. No official workaround is documented.