NCSC-TAD-2111-002
مستوى الخطورة: حرجة
ثغرة
الرقم المرجعي: NCSC-TAD-2111-002CVSS 0
Attackers Exploiting Zoho ManageEngine
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- CVE-2021-40539
نظرة عامة
APT actors are exploiting an authentication bypass vulnerability (CVE-2021-40539) in Zoho ManageEngine ADSelfService Plus. The advisory describes a second campaign exploiting the same vulnerability to deploy the Godzilla webshell, NGLite backdoor, a dropper, and the KdcSponge credential-stealer. These tools allow attackers to maintain persistent network access and gather credentials from the Active Directory server.
التقنيات المتأثرة
- Zoho ManageEngine ADSelfService Plus builds 6113 and below.
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Update ADSelfService Plus version to the latest version.
- 02
Make sure that ADSelfService Plus is not directly accessible from the internet.
- 03
As mentioned by the company, even those versions that are not yet affected must have the latest version installed.
المراجع
- Robert Falcone, J. W. (2021, November 7). Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer. Retrieved from Palo Alto Networks(يفتح في علامة تبويب جديدة)
- Vaas, L. (2021, November 8). Zoho Password Manager Flaw Torched by Godzilla Webshell. Retrieved from Threat Post(يفتح في علامة تبويب جديدة)