US Homeland Security warns of widespread attacks by Soho ADSelfService Plus

The U.S. Department of Homeland Security’s Cyber ​​and Infrastructure Security Agency (CISA), along with the Federal Bureau of Investigation (FBI) and the U.S. Coast Guard Cyber ​​Command (CGCOiper), report significant vulnerabilities from a single login into a computer. Indian software company Joho. The affected part is ADSelfService Plus of Soho’s Manage Engine software system. According to the CISA, vulnerable software is used by a number of organizations, including universities and security agencies licensed by the US government.

The dream of every executive

The vulnerability (CVE-2021-40539) is rated CVSS with a score of 9.8 (maximum 10 points). Attackers may abuse this vulnerability to avoid software connection and to execute arbitrary malicious code from the public network via the REST API. This is especially impressive because ADSelfService Plus manages access data for cloud accounts and a company’s Windows Active Directory data. This defect is very suitable for gaining access to the systems of a system and from there, moves around all parts of the network – this is called the lateral movement of the attacker.

The CISA, the FBI and the CGCYBER have already noticed such attacks. U.S. officials are therefore urging the companies and organizations involved to secure any installation of ADSLF Service Plus as soon as possible. Joho has released an update related to it (Security Fix 6114), which should be installed as soon as possible by administrators – if they are not already available.

Attacks are difficult to detect

Post-patch cleaning work in management is a long way off, as attackers can obtain administrative credentials for all types of systems on the enterprise network, including personal PCs on the network. Administrators also need to make sure that attackers have not already infiltrated the network and set foot in other organizations. According to the CISA, vulnerability is actively exploited by well-organized APD groups, which are usually very efficient at covering up traces of their attacks, making it difficult to detect attackers on one’s own network.

To exploit this vulnerability, attackers currently load a web shell disguised as an X.509 certificate into the target system via the REST API. The alleged certificate is actually the Java Server Pages (JSP) in the zip archive. Subsequent access to other API nodes then causes the system to run the web hole, allowing the attacker to access the system. From there, the attacker can then access the network domain controller using Windows Management Instrumentation (WMI).

Indicators of compromise

The CISA, FBI and CGCYBER recommend monitoring the following attack methods on the web:

• wmic.exe is used to switch between systems on the network and to run malicious code.
• Windows testimonials are read in clear text from the hijacked ADSelfService-Plus system.
• page_dump.exe Used to read databases from ManageEngine.
• NTDS.dit and log node data SECURITY/SYSTEM/NTUSER Are read
• The data collected on the network is then discharged via web tiles.
• The transactions in question are covered up using already compromised and legitimate US infrastructure.
• Attackers select and filter record entries that could deceive them.

In addition to updating and raising awareness of the ADSelfService-Plus service, U.S. officials recommend changing all domain passwords and resetting Kerberos ticketing tickets (TGTs) when viewing the NTDS.dit file.

(Fab)