CVE-2018-5353 : Security Advisory and Response

Zoho ManageEngine ADSelfService Plus before version 5.5 build 5517 is vulnerable to a remote code execution and privilege escalation attack due to a flaw in the GINA/CP module.

Understanding CVE-2018-5353

This CVE describes a security vulnerability in Zoho ManageEngine ADSelfService Plus that allows remote attackers to execute code and elevate privileges through spoofing.

What is CVE-2018-5353?

The vulnerability in the GINA/CP module of Zoho ManageEngine ADSelfService Plus enables unauthorized attackers to execute code and escalate privileges by spoofing, without authenticating the expected server.

The Impact of CVE-2018-5353

Remote attackers can execute code and elevate privileges through spoofing attacks.
The vulnerability can lead to unauthorized access and potential compromise of sensitive information.

Technical Details of CVE-2018-5353

Zoho ManageEngine ADSelfService Plus before version 5.5 build 5517 is affected by the following:

Vulnerability Description

The vulnerability allows attackers to execute code and elevate privileges by spoofing, exploiting the lack of server authentication before opening a browser window.

Affected Systems and Versions

Product: Zoho ManageEngine ADSelfService Plus
Versions affected: Prior to version 5.5 build 5517

Exploitation Mechanism

Attackers can redirect the browser to gain execution within the WinLogon.exe process.
Exploitation is possible through Remote Desktop Protocol (RDP) if Network Level Authentication is not enforced.
A misconfigured certificate on the web server can also facilitate exploitation without the need for a spoofing attack.

Mitigation and Prevention

It is crucial to take immediate steps to mitigate the risks posed by CVE-2018-5353:

Immediate Steps to Take

Update Zoho ManageEngine ADSelfService Plus to version 5.5 build 5517 or later to patch the vulnerability.
Enforce Network Level Authentication to prevent exploitation via RDP.
Ensure correct configuration of SSL certificates on web servers to mitigate the risk of spoofing attacks.

Long-Term Security Practices

Regularly monitor and update software to address security vulnerabilities promptly.
Conduct security assessments and penetration testing to identify and remediate potential weaknesses.

Patching and Updates

Stay informed about security advisories and updates from Zoho ManageEngine.
Apply patches and updates in a timely manner to protect systems from known vulnerabilities.