ManageEngine - Remote Code Execution (CVE-2022-47966)

ManageEngine server is vulnerable to CVE-2022-47966, a Remote Code Execution vulnerability in the /SamlResponseServlet endpoint. The vulnerability allows an attacker to gain Remote Code Execution by issuing an HTTP POST request containing a malicious SAML response. This vulnerability is a result of using an outdated version of Apache Santuario for XML signature validation.

The risk exists that a remote unauthenticated attacker can fully compromise the server in order to steal confidential information, install ransomware, or pivot to the internal network.

Sniper can gain unauthenticated Remote Code Execution on the target system and extract multiple artefacts as evidence.

Upgrade the ManageEngine to the latest version.

https://nvd.nist.gov/vuln/detail/CVE-2022-47966

https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html