Exchange CVE-2025-3835

This vulnerability presents CRITICAL real-world risk despite the user interaction requirement. CVSS 9.6 reflects the severe impact (C:H, I:H, A:H across system boundary S:C), but the UI:R factor and AC:L provide important context: the attack is not purely automated remote exploitation, yet remains trivially easy to execute once a user is engaged. Without confirmed EPSS score and KEV status, conservative assessment suggests high exploitability probability given: (1) file upload vulnerabilities are well-understood and frequently exploited, (2) no authentication required (PR:N) dramatically lowers the barrier, (3) network-accessible attack surface, and (4) the specific nature of the vulnerability (CWE-434) maps to predictable exploitation patterns. The requirement for user interaction (UI:R) may indicate the attacker must trick a user into uploading a malicious file or clicking a link, or alternatively, the interaction may be incidental (e.g., automated upload trigger). If POC is public or this is in active exploitation (KEV status), priority escalates immediately. Organizations running Exchange Reporter Plus <=5721 should treat this as urgent if: the product is internet-facing, processes untrusted content, or serves as a trust boundary for sensitive Exchange data.

An attacker discovers a Zohocorp ManageEngine Exchange Reporter Plus instance (version ≤5721) accessible on the internet or internal network. The attacker navigates to the Content Search module. Due to improper file type validation (CWE-434), the attacker uploads a malicious file—potentially a JSP web shell, executable script, or executable binary disguised with a benign extension or MIME type. The Content Search module processes the upload without validation, storing or executing the file on the server. The attacker then accesses the uploaded file (via a predictable path or by triggering its execution), gaining arbitrary code execution with the privileges of the ManageEngine process (often SYSTEM or a high-privilege service account on Windows, root on Linux). From this foothold, the attacker can: (a) exfiltrate Exchange data or organization data accessible to the reporting service, (b) pivot to connected Exchange servers or other enterprise systems, (c) establish persistence, or (d) disrupt availability. The UI:R requirement may mean the attacker either: crafts a phishing email linking to an upload form, tricks an administrator into uploading a file, or the interaction is minimal (e.g., a single click required). Alternative scenario: If the Content Search module auto-processes certain file types or accepts uploads via API without full UI interaction, the effective attack complexity could be lower than UI:R suggests.