CVE-2024-45518

Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) flaw, CVE-2024-45518, caused by improper input sanitization and a misconfigured domain whitelist. An authenticated user with only low-level privileges can trigger the flaw to make the Zimbra server send unauthorized HTTP requests to services on the internal network. By chaining the SSRF with command injection in a reachable internal service, the attacker can achieve remote code execution; combining the SSRF with existing cross-site scripting vulnerabilities also yields RCE. All supported ZCS branches are affected: 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the elevated EPSS score (20.7% probability of exploitation in 30 days, 97th percentile) indicates significant exploitation risk.

What to do: Upgrade to ZCS 10.1.1, 10.0.9, 9.0.0 Patch 41, or 8.8.15 Patch 46 (or later) to remediate. Until patched, enforce a strict and correctly configured domain whitelist for the affected feature, map which internal services the Zimbra host can reach, and monitor for anomalous internal HTTP requests originating from the server. Since authentication is required, review accounts on internet-exposed webmail for low-privilege or compromised credentials that could be used as a launch point.