ManageEngine ADSelfService Plus - Remote Code Execution (CVE-2021-40539)

ManageEngine ADSelfService Plus is affected by an unauthenticated Remote Code Execution vulnerability, located in the REST API routing service. The root cause of this vulnerability consists in a change done to the path normalization.

The risk exists that a remote unauthenticated attacker can fully compromise the server in order to steal sensitive information, install ransomware or pivot to the internal network.

Sniper can gain unauthenticated Remote Code Execution on the target system and extract multiple artefacts as evidence.

Upgrade the ManageEngine ADSelfService Plus to a version higher than 6113.

https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html