Proof-of-Concept Published for Unauthenticated RCE in Zoho ManageEngine ADAudit Plus (CVE-2022-28219)

On June 29, researchers at Horizon3.ai published a blog post about a recently disclosed vulnerability in Zoho ManageEngine ADAudit Plus, a compliance tool that monitors Active Directory.

CVE-2022-28219 is an unauthenticated RCE caused by underlying Java deserialization, blind XML external entity injection and path traversal vulnerabilities. This chain of flaws could be exploited to not only achieve RCE, but also compromise domain administrator accounts. This effect of the flaw will make it very attractive to ransomware groups and initial access brokers.

For more information, please visit our blog.