CVE-2022-24681: ManageEngine ADSelfService Plus XSS Flaw

CVE-2022-24681 Overview

CVE-2022-24681 is a Cross-Site Scripting (XSS) vulnerability affecting Zoho ManageEngine ADSelfService Plus, a widely-deployed self-service password management and single sign-on solution for Active Directory environments. The vulnerability exists in versions prior to build 6121 and allows attackers to inject malicious scripts through the welcome name attribute on critical authentication screens including Reset Password, Unlock Account, and User Must Change Password pages.

This XSS vulnerability is particularly concerning because it targets authentication-related interfaces where users are likely to enter credentials, making it an attractive vector for credential theft and phishing attacks within enterprise environments.

Critical Impact

Attackers can inject malicious JavaScript through the welcome name attribute on authentication screens, potentially stealing user credentials, session tokens, or performing unauthorized actions within the context of authenticated users.

Affected Products

• Zoho ManageEngine ADSelfService Plus versions prior to build 6121
• Zoho ManageEngine ADSelfService Plus version 6.1 (builds 6100 through 6120)
• All previous ADSelfService Plus builds without the security patch

Discovery Timeline

• April 7, 2022 - CVE-2022-24681 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-24681

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in how ADSelfService Plus handles the welcome name attribute when rendering user-facing password management screens.

When users interact with the Reset Password, Unlock Account, or User Must Change Password functionality, the application displays a personalized welcome message. The vulnerability allows an attacker to inject malicious JavaScript code into this welcome name field, which is then rendered without proper sanitization when the affected screens are displayed to end users.

The attack requires user interaction, as victims must navigate to a crafted URL or page containing the malicious payload. However, given that these screens are commonly accessed during routine password management activities, social engineering attacks leveraging this vulnerability have a high probability of success.

Root Cause

The root cause of CVE-2022-24681 is insufficient input validation and output encoding on the welcome name attribute within the ADSelfService Plus application. The application fails to properly sanitize user-controlled input before reflecting it back to the browser, allowing JavaScript code to be executed in the context of the victim's session.

Specifically, the affected code paths do not implement adequate HTML entity encoding or Content Security Policy protections that would prevent injected scripts from executing. This allows attackers to break out of the intended HTML context and inject arbitrary JavaScript payloads.

Attack Vector

The attack is network-based and requires social engineering to trick users into clicking malicious links. An attacker could craft a URL containing a malicious payload in the welcome name parameter and distribute it via phishing emails, compromised websites, or other delivery mechanisms.

When a victim accesses the crafted URL, the XSS payload executes in their browser with the same privileges as the legitimate ADSelfService Plus application. This enables various attack scenarios including session hijacking, credential theft through fake login forms, and redirection to attacker-controlled infrastructure.

Since this vulnerability targets password reset and account unlock screens, attackers have a natural pretext for social engineering—users expect to interact with these pages when managing their Active Directory credentials.

Detection Methods for CVE-2022-24681

Indicators of Compromise

• Unusual JavaScript payloads in web server access logs for ADSelfService Plus authentication endpoints
• URLs containing encoded script tags or JavaScript event handlers in the welcome name parameter
• Unexpected outbound connections from client browsers following visits to ADSelfService Plus pages
• Reports from users of unexpected behavior or prompts on password management screens

Detection Strategies

• Review web application firewall (WAF) logs for requests containing XSS patterns targeting ADSelfService Plus endpoints
• Implement content inspection rules to detect common XSS payload signatures in URL parameters
• Monitor for phishing campaigns that reference your organization's ADSelfService Plus instance
• Deploy browser-based security controls that can detect and block reflected XSS attacks

Monitoring Recommendations

• Enable detailed logging on ADSelfService Plus web server to capture full request URLs
• Configure alerting for anomalous access patterns to password reset and unlock account pages
• Implement user awareness training to recognize suspicious links targeting internal applications
• Use SentinelOne Singularity Platform to monitor for post-exploitation behavior on endpoints that may result from successful XSS attacks

How to Mitigate CVE-2022-24681

Immediate Actions Required

• Upgrade Zoho ManageEngine ADSelfService Plus to build 6121 or later immediately
• Review web server logs for any evidence of exploitation attempts
• Notify users to be cautious of links claiming to direct them to password reset or account unlock pages
• Consider temporarily restricting external access to ADSelfService Plus if patching is delayed

Patch Information

Zoho has released a security patch in ADSelfService Plus build 6121 that addresses this XSS vulnerability. Organizations should upgrade to this version or later to remediate the issue. Detailed patch information and upgrade instructions are available in the ManageEngine CVE-2022-24681 Advisory.

Additional technical analysis is available in the Raxis CVE-2022-24681 Blog.

Workarounds

• Deploy a web application firewall (WAF) with XSS protection rules in front of ADSelfService Plus
• Implement Content Security Policy (CSP) headers at the reverse proxy level to restrict script execution
• Limit network access to ADSelfService Plus to trusted internal networks only
• Use link inspection and URL filtering at the email gateway to block phishing attempts

# Example: Apache reverse proxy CSP header configuration
# Add to virtual host configuration for ADSelfService Plus
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"