CVE-2024-0252: Remote code execution (RCE) vulnerability in ManageEngine ADSelfService Plus

In January 2024, a critical security vulnerability was identified in ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution for Active Directory and cloud applications. This vulnerability, designated as CVE-2024-0252, allows authenticated users to execute arbitrary code remotely on the system where ADSelfService Plus is installed. This blog post provides an in-depth analysis of the vulnerability, its potential impact, and recommended mitigation strategies.​Red Hat Customer Portal+11Qualys ThreatPROTECT+11ManageEngine+11Qualys ThreatPROTECT+3ManageEngine+3Security Boulevard+3

Understanding CVE-2024-0252

CVE-2024-0252 is a remote code execution (RCE) vulnerability found in the load balancer component of ManageEngine ADSelfService Plus versions 6401 and earlier. The flaw arises from improper handling within this component, which can be exploited by an authenticated user to execute arbitrary code on the host system. This could lead to unauthorized access, data breaches, or further exploitation within the network. ​GitHub+6INCIBE+6SecAlerts+6ManageEngine

Technical Details

While specific technical details and proof-of-concept (PoC) exploit code for CVE-2024-0252 have not been publicly disclosed, the vulnerability is attributed to improper control of code generation, classified under CWE-94: Improper Control of Generation of Code (‘Code Injection’). This indicates that the application fails to properly sanitize user input, allowing attackers to inject and execute malicious code. ​OpenCVE+3Feedly+3NVD+3

Impact Assessment

The vulnerability has been assigned a CVSS v3.1 base score of 8.8, categorizing it as High severity. The breakdown of the score is as follows:​

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: Low

• User Interaction: None

• Scope: Unchanged

• Confidentiality Impact: High

• Integrity Impact: High

• Availability Impact: High

This assessment underscores the ease with which the vulnerability can be exploited and the significant potential impact on confidentiality, integrity, and availability. ​

Affected Versions

The vulnerability affects ManageEngine ADSelfService Plus builds 6401 and earlier. All installations of ADSelfService Plus, regardless of load balancer configurations, are susceptible to this issue. ​Security Boulevard+11Qualys ThreatPROTECT+11INCIBE+11Feedly+4ManageEngine+4Qualys ThreatPROTECT+4

Mitigation Strategies

To protect your systems from potential exploitation of CVE-2024-0252, it is crucial to implement the following measures:

1. Update to the Latest Version: Upgrade ADSelfService Plus to build 6402 or later, where the vulnerability has been addressed. The update includes:​ManageEngine+1Qualys ThreatPROTECT+1

   • Restrictions on communication processes within the load balancer component.​CVE Database+9Qualys ThreatPROTECT+9ManageEngine+9

   • Restrictions preventing domain users from accessing load balancer APIs. ​ManageEngine+1Qualys ThreatPROTECT+1

2. Restrict Access: Limit access to the ADSelfService Plus interface to only trusted users and networks.​INCIBE+11ManageEngine+11Security Boulevard+11

3. Monitor and Audit: Regularly monitor and audit system logs for any unusual or unauthorized activities.​

4. Apply Principle of Least Privilege: Ensure that users have only the minimum level of access necessary for their roles.​

For detailed instructions on updating your ADSelfService Plus installation, refer to the official ManageEngine advisory.​Security Boulevard+10ManageEngine+10Qualys ThreatPROTECT+10

Conclusion

CVE-2024-0252 represents a significant security risk for organizations utilizing vulnerable versions of ManageEngine ADSelfService Plus. By promptly updating to the latest version and implementing robust security practices, organizations can mitigate the risk associated with this vulnerability. Staying vigilant and proactive in applying security updates is essential in maintaining a secure IT environment.