CVE-2021-37417

Vulnerability

Zoho ManageEngine ADSelfService Plus version 6103 and prior contains a CAPTCHA bypass vulnerability. The web application fails to properly validate the EXCLUDE_CAPTCHA parameter in the login request to the /j_security_check endpoint. An attacker can append EXCLUDE_CAPTCHA=true to the request body to bypass the CAPTCHA check, even when the "Show CAPTCHA on Login Page every time" setting is enabled [1].

Exploitation

An attacker with network access to the login page can exploit this by intercepting the HTTP POST request (e.g., using a proxy like Burp Suite). The attacker enters any value in the CAPTCHA field, then adds the EXCLUDE_CAPTCHA=true parameter to the request body. The server processes the request and logs the user in, despite the incorrect CAPTCHA value. This requires no authentication beforehand and can be performed remotely [1].

Impact

Successful exploitation allows the attacker to bypass the CAPTCHA mechanism, enabling automated brute-force attacks on user credentials. While the vulnerability does not directly lead to information disclosure or remote code execution, it significantly weakens a login security control, potentially leading to account compromise. The CVSS score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects the low availability impact, but the real-world impact is facilitating credential attacks [1].

Mitigation

The vulnerability is fixed in version 6104, released on 08-05-2021. Users should upgrade to ManageEngine ADSelfService Plus version 6104 or later. No workarounds are documented. The vendor was notified on 17-03-2021, and the fix was released approximately two months later [1].