.. / CVE-2022-35405

Exploit for Zoho ManageEngine - Remote Code Execution (CVE-2022-35405)

Description:

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

Nuclei Template

View the template here CVE-2022-35405.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-35405.yaml
Copy

References:

https://xz.aliyun.com/t/11578
https://nvd.nist.gov/vuln/detail/CVE-2022-35405
https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb
https://www.bigous.me/2022/09/06/CVE-2022-35405.html