CVE-2022-28219: ManageEngine ADAudit Plus RCE Vulnerability

CVE-2022-28219 Overview

CVE-2022-28219 is a critical XML External Entity (XXE) vulnerability affecting the Cewolf component in Zoho ManageEngine ADAudit Plus versions prior to build 7060. This vulnerability allows unauthenticated remote attackers to exploit improper XML parsing, ultimately leading to Remote Code Execution (RCE) on affected systems. ManageEngine ADAudit Plus is widely deployed for Active Directory auditing and compliance reporting, making this vulnerability particularly dangerous for enterprise environments.

Critical Impact

Unauthenticated attackers can achieve Remote Code Execution through XXE exploitation, potentially compromising Active Directory audit infrastructure and gaining access to sensitive enterprise security data.

Affected Products

• Zoho ManageEngine ADAudit Plus versions prior to build 7060
• ManageEngine ADAudit Plus 7.0 builds 7000 through 7054
• Systems using the vulnerable Cewolf charting component

Discovery Timeline

• 2022-04-05 - CVE-2022-28219 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-28219

Vulnerability Analysis

This vulnerability resides in the Cewolf charting library integrated within ManageEngine ADAudit Plus. Cewolf is an open-source Java library used for generating charts and graphs in web applications. The vulnerability stems from improper handling of XML input, specifically the failure to disable external entity processing in the XML parser configuration.

The attack chain typically involves three distinct vulnerability types working in concert: path traversal, XML External Entity injection, and Java deserialization. An attacker can first leverage path traversal to write a malicious serialized Java object to a predictable location on the target system. Subsequently, the XXE vulnerability in the Cewolf component can be exploited to trigger deserialization of the malicious object, resulting in arbitrary code execution with the privileges of the ADAudit Plus service account.

Root Cause

The root cause is classified as CWE-611: Improper Restriction of XML External Entity Reference. The Cewolf component fails to properly configure the XML parser to prevent processing of external entities. When parsing XML input, the application allows external entity references to be resolved, enabling attackers to read arbitrary files, perform Server-Side Request Forgery (SSRF), or in combination with other vulnerabilities, achieve Remote Code Execution.

The underlying issue is the absence of secure XML parser configuration that would disable DOCTYPE declarations and external entity processing. Modern secure coding practices require explicitly disabling features like FEATURE_EXTERNAL_GENERAL_ENTITIES and FEATURE_EXTERNAL_PARAMETER_ENTITIES in XML parsers.

Attack Vector

The attack is network-based and requires no authentication or user interaction. Attackers can target the vulnerable endpoint remotely over HTTP/HTTPS. The exploitation flow typically involves:

1. Crafting a malicious XML payload containing external entity declarations
2. Sending the payload to the vulnerable Cewolf endpoint in ADAudit Plus
3. The XML parser processes the external entities, enabling file read or SSRF
4. Combined with path traversal and deserialization flaws, attackers can achieve RCE

The vulnerability is particularly severe because ManageEngine ADAudit Plus servers often have network access to domain controllers and contain sensitive Active Directory audit information.

Detection Methods for CVE-2022-28219

Indicators of Compromise

• Unusual HTTP requests to Cewolf-related endpoints such as /cewolf/ paths
• XML payloads containing DOCTYPE declarations or ENTITY references in web server logs
• Unexpected outbound network connections from the ADAudit Plus server
• Suspicious file creation or modification in web-accessible directories
• Java deserialization-related process spawns from the ADAudit Plus service

Detection Strategies

• Monitor web application logs for requests containing XXE patterns such as <!DOCTYPE and <!ENTITY
• Implement network-based detection for anomalous traffic patterns to/from ADAudit Plus servers
• Deploy file integrity monitoring on ADAudit Plus installation directories
• Analyze process creation events for child processes spawned by the Java service running ADAudit Plus

Monitoring Recommendations

• Enable verbose logging on ADAudit Plus and forward logs to a SIEM platform
• Configure alerts for any outbound connections from the ADAudit Plus server to unexpected destinations
• Monitor for reconnaissance activity targeting ManageEngine products on network perimeter
• Review authentication logs for any unauthorized access attempts following potential exploitation

How to Mitigate CVE-2022-28219

Immediate Actions Required

• Upgrade ManageEngine ADAudit Plus to build 7060 or later immediately
• Restrict network access to ADAudit Plus servers using firewall rules to limit exposure
• Review server logs for indicators of compromise before and after patching
• Consider isolating ADAudit Plus servers pending patch deployment if immediate upgrade is not possible

Patch Information

Zoho ManageEngine has released a security update addressing this vulnerability. Organizations should upgrade to ADAudit Plus build 7060 or later to remediate CVE-2022-28219. The official security advisory and patch information is available at the ManageEngine CVE-2022-28219 Page. Additional technical analysis is available from the Horizon3 Red Team Blog.

Workarounds

• Implement Web Application Firewall (WAF) rules to block XML payloads containing external entity declarations
• Restrict network access to ADAudit Plus to only authorized management networks
• If possible, disable or block access to the vulnerable Cewolf endpoint until patching is complete
• Deploy network segmentation to limit lateral movement potential if exploitation occurs

# Example: Restrict access to ADAudit Plus using Windows Firewall
# Allow only specific management subnets to access the web interface
netsh advfirewall firewall add rule name="Block ADAudit Plus External" dir=in action=block protocol=tcp localport=8081
netsh advfirewall firewall add rule name="Allow ADAudit Plus Management" dir=in action=allow protocol=tcp localport=8081 remoteip=10.0.0.0/24