CVE-2021-37416

Vulnerability

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to a reflected cross-site scripting (XSS) vulnerability in the loadframe page. The vulnerability exists in the /LoadFrame endpoint and manifests due to insufficient sanitization of the single_signout parameter. An attacker can inject arbitrary JavaScript code via a crafted URL. Affected versions are those prior to build 6104 [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL that includes a payload in the single_signout parameter. The provided proof-of-concept URL demonstrates injection of an iframe break and a script tag that executes alert(1). To trigger the attack, a victim must be persuaded to visit the crafted URL; no authentication is required, as the endpoint is publicly accessible. The exploit occurs in the context of the victim's browser session, and no special network position or privileges are needed [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the security context of the ADSelfService Plus application. This can lead to theft of session cookies, modification of page content, or redirection to malicious sites, potentially enabling account takeover. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating low confidentiality and integrity impact with a changed scope [1].

Mitigation

Zoho released a fixed version (build 6104) on 8 May 2021, which addresses this vulnerability. Users are advised to upgrade to version 6104 or later. No workarounds have been published for older, unsupported versions. The vulnerability was responsibly disclosed to the vendor on 17 March 2021, and public disclosure occurred on 30 August 2021 [1].