CVE-2022-28219

Vulnerability

The vulnerability resides in the Cewolf charting library's CewolfRenderer servlet exposed at /cewolf endpoint in ManageEngine ADAudit Plus versions before build 7060. It involves an unauthenticated blind XML External Entities (XXE) injection, combined with untrusted Java deserialization and path traversal in the FileStorage class. The XXE can be used to write a malicious serialized Java object to an arbitrary location on disk, which is then deserialized by the same endpoint, leading to code execution. [1][3]

Exploitation

An unauthenticated attacker can send a crafted HTTP request to the /cewolf endpoint with a malicious XML payload containing an external entity that writes a serialized Java object to a chosen file path. The attacker must also provide a valid img parameter to specify the file path for deserialization. The Cewolf library does not sanitize the img parameter, allowing path traversal. The attacker can then trigger deserialization of the uploaded payload, executing arbitrary code. No authentication or user interaction is required. [1]

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the ADAudit Plus server with the privileges of the application (typically SYSTEM or a high-privilege service account). This can lead to full compromise of the server and, due to the application's privileged access to Active Directory, potential escalation to domain administrator privileges. [1][3]

Mitigation

The vulnerability is fixed in ADAudit Plus build 7060, released on March 30, 2022. Users should upgrade to build 7065 or later. No workarounds are available. The vendor has also released an exploit detection tool. Public proof-of-concept exploit code is available, and the vulnerability is likely to be exploited. [3]