ManageEngine Exchange Reporter Plus stored XSS in Permissions based on Distribution Groups report

# check-CVE-2026-28756.ps1

# Exit codes:

#   0 = PATCHED

#   1 = VULNERABLE

#   2 = UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Write-Result {
    param(
        [string]$State,
        [string]$Detail,
        [int]$Code
    )
    Write-Output "$State - $Detail"
    exit $Code
}

function Get-BuildFromString {
    param([string]$Text)
    if ([string]::IsNullOrWhiteSpace($Text)) { return $null }

    $patterns = @(
        '(?i)build\s*[:#-]?\s*(\d{4,5})',
        '(?<!\d)(\d{4,5})(?!\d)',
        '(\d+)\.(\d+)\.(\d{4,5})',
        '(\d+)\.(\d{4,5})'
    )

    foreach ($p in $patterns) {
        $m = [regex]::Match($Text, $p)
        if ($m.Success) {
            # Prefer the last numeric group that looks like a build

            for ($i = $m.Groups.Count - 1; $i -ge 1; $i--) {
                $val = $m.Groups[$i].Value
                if ($val -match '^\d{4,5}$') {
                    return [int]$val
                }
            }
        }
    }
    return $null
}

function Get-InstallCandidates {
    $candidates = New-Object System.Collections.Generic.List[string]

    $uninstallRoots = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    foreach ($root in $uninstallRoots) {
        Get-ItemProperty $root | ForEach-Object {
            if ($_.DisplayName -match 'Exchange Reporter Plus') {
                if ($_.InstallLocation) { [void]$candidates.Add($_.InstallLocation) }
            }
        }
    }

    $svc = Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'Exchange Reporter Plus' -or $_.DisplayName -match 'Exchange Reporter Plus' } | Select-Object -First 1
    if ($svc -and $svc.PathName) {
        $path = $svc.PathName.Trim('"')
        if (Test-Path $path) {
            $dir = Split-Path $path -Parent
            if ($dir) { [void]$candidates.Add($dir) }
            $parent = Split-Path $dir -Parent
            if ($parent) { [void]$candidates.Add($parent) }
        }
    }

    $defaults = @(
        'C:\Program Files\ManageEngine\Exchange Reporter Plus',
        'C:\ManageEngine\Exchange Reporter Plus'
    )
    foreach ($d in $defaults) { [void]$candidates.Add($d) }

    return $candidates | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique
}

# 1) Try uninstall registry first

$registryFindings = @()
$uninstallRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($root in $uninstallRoots) {
    Get-ItemProperty $root | ForEach-Object {
        if ($_.DisplayName -match 'Exchange Reporter Plus') {
            $registryFindings += $_
        }
    }
}

foreach ($item in $registryFindings) {
    $versionText = @($item.DisplayVersion, $item.DisplayName) -join ' '
    $build = Get-BuildFromString -Text $versionText
    if ($build -ne $null) {
        if ($build -lt 5802) {
            Write-Result 'VULNERABLE' "Registry indicates build $build (< 5802). Source: $($item.DisplayName) $($item.DisplayVersion)" 1
        } else {
            Write-Result 'PATCHED' "Registry indicates build $build (>= 5802). Source: $($item.DisplayName) $($item.DisplayVersion)" 0
        }
    }
}

# 2) Try install path files for build/version hints

$paths = Get-InstallCandidates
foreach ($base in $paths) {
    $textFiles = @(
        Join-Path $base 'README.txt',
        Join-Path $base 'readme.txt',
        Join-Path $base 'version.txt',
        Join-Path $base 'build.txt',
        Join-Path $base 'conf\product.conf',
        Join-Path $base 'bin\wrapper.conf'
    )

    foreach ($f in $textFiles) {
        if (Test-Path $f) {
            $content = Get-Content $f -TotalCount 200 | Out-String
            $build = Get-BuildFromString -Text $content
            if ($build -ne $null) {
                if ($build -lt 5802) {
                    Write-Result 'VULNERABLE' "File $f indicates build $build (< 5802)." 1
                } else {
                    Write-Result 'PATCHED' "File $f indicates build $build (>= 5802)." 0
                }
            }
        }
    }

    # 3) Fall back to executable version metadata

    $exeCandidates = Get-ChildItem -Path $base -Recurse -Include *.exe -File | Where-Object {
        $_.Name -match 'Exchange|Reporter|ManageEngine'
    } | Select-Object -First 25

    foreach ($exe in $exeCandidates) {
        $verText = @($exe.VersionInfo.FileVersion, $exe.VersionInfo.ProductVersion, $exe.Name) -join ' '
        $build = Get-BuildFromString -Text $verText
        if ($build -ne $null) {
            if ($build -lt 5802) {
                Write-Result 'VULNERABLE' "Executable $($exe.FullName) indicates build $build (< 5802)." 1
            } else {
                Write-Result 'PATCHED' "Executable $($exe.FullName) indicates build $build (>= 5802)." 0
            }
        }
    }
}

Write-Result 'UNKNOWN' 'Could not confidently determine the installed Exchange Reporter Plus build. Check the web console License page or the service-pack UI for the build number.' 2