CVE-2024-41150: ManageEngine ServiceDesk Plus XSS Vulnerability

CVE-2024-41150 Overview

CVE-2024-41150 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the request module of Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus. An authenticated attacker can inject malicious script content that persists within request records. The payload executes in the browser of any user who later views the affected request, including help desk technicians and administrators.

The flaw affects ServiceDesk Plus builds through 14810, ServiceDesk Plus MSP builds through 14800, and SupportCenter Plus builds through 14800. Zoho published a vendor advisory documenting affected builds and remediation guidance.

Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in the session context of authenticated users, enabling session hijacking, credential theft, and unauthorized actions inside the ITSM platform.

Affected Products

ManageEngine ServiceDesk Plus — versions through build 14810
ManageEngine ServiceDesk Plus MSP — versions through build 14800
ManageEngine SupportCenter Plus — versions through build 14800

Discovery Timeline

2024-08-23 - CVE-2024-41150 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41150

Vulnerability Analysis

The vulnerability resides in the request module, which handles service tickets submitted by end users and technicians. Input fields associated with request creation or modification are not adequately sanitized before rendering. An attacker submits a request containing a crafted JavaScript payload embedded in a vulnerable field. When another authenticated user views that request through the web interface, the browser interprets and executes the payload.

Because the payload is persisted in the application database, the attack triggers repeatedly without further interaction from the attacker. User interaction from the victim is required to view the request, and the vulnerability scope changes because injected scripts execute against a different security context than the attacker's own.

Root Cause

The root cause is improper neutralization of user-supplied input during web page generation. Request-module handlers accept HTML or script fragments and echo them into rendered pages without contextual output encoding. Standard XSS defenses such as strict HTML escaping, Content Security Policy enforcement, and input validation against an allow list are either missing or incomplete in affected builds.

Attack Vector

The attack is network-based and requires no privileges on the attacker side beyond the ability to submit a request, which many ManageEngine deployments allow for end users, portal accounts, or self-service users. The attacker submits a request containing a JavaScript payload in an unsanitized field. Technicians, administrators, or other users triggering the request view execute the script under their session. Attackers can steal session cookies, perform actions on behalf of privileged operators, or pivot to internal administrative functions of the ITSM platform.

No verified public exploit or proof-of-concept has been published. See the ManageEngine CVE-2024-41150 Advisory for vendor technical details.

Detection Methods for CVE-2024-41150

Indicators of Compromise

Request records containing HTML tags such as <script>, <img onerror=...>, or event handler attributes in subject, description, or custom fields
Outbound HTTP requests from technician browsers to unexpected external hosts shortly after opening a service request
Anomalous session cookie usage from geographically distant IP addresses within short time windows
Unexpected privilege changes, ticket approvals, or account modifications performed by technician accounts

Detection Strategies

Inspect ServiceDesk Plus application logs for request submissions containing script tags or JavaScript event handler patterns
Deploy web application firewall rules that flag common XSS payloads targeting the /WorkOrder.do and related request endpoints
Correlate technician session activity with unusual DOM-based navigation or outbound network beacons using endpoint telemetry

Monitoring Recommendations

Enable verbose audit logging in ManageEngine and forward events to a centralized SIEM for retention and correlation
Monitor for creation of new administrator accounts or role changes originating from technician sessions
Track browser process network connections from workstations that regularly access the ServiceDesk Plus web console

How to Mitigate CVE-2024-41150

Immediate Actions Required

Upgrade ServiceDesk Plus to a build later than 14810, and ServiceDesk Plus MSP and SupportCenter Plus to builds later than 14800
Review recent request submissions for embedded HTML or script content and purge suspicious entries
Rotate session tokens and force reauthentication for technician and administrator accounts following patch deployment

Patch Information

Zoho has released fixed builds addressing this vulnerability. Refer to the ManageEngine CVE-2024-41150 Advisory for the specific patched build numbers applicable to each product line and download links.

Workarounds

Restrict end-user request submission to authenticated internal users where business processes allow
Implement a reverse proxy or WAF rule set that inspects and blocks common XSS payload patterns targeting request module endpoints
Limit technician account privileges using role-based access control to reduce impact if a session is hijacked
Enforce browser-side protections including strict Content Security Policy headers at the reverse proxy layer

bash

# Example WAF rule to flag script tags in request fields (ModSecurity syntax)
SecRule ARGS:description|ARGS:subject "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1041150,phase:2,deny,status:403,msg:'Potential XSS payload in ServiceDesk request field'"