About Admanager plus
An authentication bypass vulnerability affecting the REST API URLs in ManageEngine ADManager Plus has been addressed recently. This article explains the vulnerability and the steps to fix it. What is the issue? An authentication bypass vulnerability that affects REST API URLs in ADManager Plus. Whom does it affect? Customers using ADManager Plus builds 7111 and earlier are affected. What is the severity level of this vulnerability? This is a critical vulnerability. How do I identify if my installation has been affected? ManageEngine has developed a tool to check if an ADManager Plus installation has been affected by this vulnerability. Follow the below steps to install and run the tool to check your instance. Download the ZIP file from here and extract its content to \bin folder. Right-click on the Scan.bat file, and select 'Run as administrator'. If there is a possibility of an exploit, a command prompt window will open and display the following message: "There is a possibility that your ADManager Plus server setup has been exploited. Please upload your logs at and reach out to our Support team support@admanagerplus.com immediately." Alternatively, you can check for specific log entries manually by following these steps: In \ManageEngine\ADManager Plus\logs folder, search the access log entries for the below strings: /../RestAPI/ /..;/RestAPI/ ///RestAPI/ /./RestAPI The image below shows the access log entry: There is a possibility that your ADManager Plus server setup has been exploited if you find any of the above entries in the logs.What if I find that my installation is compromised?If you find that your ADManager Plus installation is compromised, follow these steps: Isolate the machine in which ADManager Plus is installed. Backup the ADManager Plus database. Download and install ADManager Plus on a different machine and then restore the DB backup. For step-by-step information on how to do this, refer to 'Method 2' on this page. Once the server is functional, upgrade the product to build 7112 or later versions using the service pack from here. Check for any unauthorized access or usage of your employees' accounts. Also, check for any evidence of lateral movement from the compromised
Key features of the Admanager plus that are enabled through these drivers include:
- Macros in ADManager Plus - ManageEngine
- Integrate Applications to ADManager Plus
- Uninstall of ADManager Plus - ManageEngine
- ADManager Plus Trusted By - ManageEngine
- ADManager Plus MSP - Channel IT
- ADManager Plus integration with third
- ManageEngine ADManager Plus 7.0.0
How to configure two-factor authentication (2FA) for technicians in ADManager Plus Objective: To configure two-factor authentication (2FA) for technicians in ADManager Plus. Solution: You can configure a secured login to the ADManager Plus console by configuring two-factor authentication (2FA). If ADManager Plus technicians have 2FA enabled, they must authenticate twice: first by entering their credentials and then by any other method enabled by the admin to login to the console. However, the ADManager Plus default admin account is allowed to skip 2FA. ADManager Plus allows 2FA to be performed through authentication services such as: Duo Security Google Authenticator RSA Authenticator Microsoft Authenticator SMS Verification One time password (OTP) via email. Steps to configure 2FA in ADManager Plus using different applications Login to ADManager Plus and click the Delegation tab. Under the Configuration section in the left pane, click Logon Settings. Click the Two Factor Authentication tab. Toggle the Two Factor Authentication button on. Select any of the following authentication services for 2FA: Duo Security Login to your Duo Security account, and navigate to the Applications > Protect an application section in the left pane. Search for Web SDK from the list of applications and click Protect. Refer here for more information on Web SDKv4 Copy the Client ID, Client secret, and API hostname. Now, go to the ADManager Plus console and expand Duo Security. Check the Enable Duo Security option and select Web v4 SDK as the Integration Type. Paste the Client ID, Client secret, and API hostname obtained from the Duo Admin Panel in the respective fields. Enter the same username pattern used in Duo Security in the Username Pattern field. Click Save. Google Authenticator Install and set up Google Authenticator on your smartphone by following the steps listed on this page. Switch to ADManager Plus and expand Google Authenticator. Click the Enable Google Authenticator button. While logging in to ADManager Plus, enter the code generated by the Google Authenticator app in your smartphone, in addition to your username and password. One time password via email In order to receive OTP via email, you need to configure the email
