Zimbra Releases Patch for Actively Exploited Vulnerability in its Collaboration Suite
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-41352 | Path Traversal Arbitrary File Upload in Synacor Zimbra Collaboration Suite CVE-2022-41352 is an unauthenticated arbitrary file upload flaw in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0, rooted in a path traversal weakness (CWE-22) in how the amavis mail scanner hands archives to the cpio utility. An attacker sends a specially crafted archive via email; cpio follows traversal entries and extracts attacker-controlled files into the web root at /opt/zimbra/jetty/webapps/zimbra/public. Uploaded files in that web-accessible directory can lead to remote code execution and incorrect access to other users' accounts, giving network-level attackers high impact on confidentiality, integrity, and availability (CVSS 9.8). Any ZCS 8.8.15 or 9.0 deployment that processes mail with cpio is affected, particularly on Red Hat/CentOS 7 and later where the pax utility (which Zimbra recommends as the safe alternative) is not installed by default. The flaw is actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-10-20 with known ransomware use, carries a 95.5% EPSS score, and public reporting ties Zimbra exploitation to campaigns including Russia-linked Sandworm/Seashell Blizzard access operations. Do: Apply updates per vendor instructions, and as an immediate mitigation install the pax package on the Zimbra host (amavis automatically prefers pax over cpio once it is present; note pax is not in default Red Hat installations after RHEL/CentOS 6, while it is a prerequisite on Ubuntu). Also inspect /opt/zimbra/jetty/webapps/zimbra/public for unexpected uploaded files and review mail flow logs for suspicious archive attachments, given confirmed in-the-wild and ransomware-related exploitation. | 9.8 | 95% | KEV ransomware PoC |
| largetens of thousands of internet-exposed Zimbra servers (public scan counts have shown roughly 40,000-60,000 exposed instances) |
Full article349 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 17, 2022
Zimbra has released patches to contain an actively exploited security flaw in its enterprise collaboration suite that could be leveraged to upload arbitrary files to vulnerable instances.
Tracked as CVE-2022-41352 (CVSS score: 9.8), the issue affects a component of the Zimbra suite called Amavis, an open source content filter, and more specifically, the cpio utility it uses to scan and extract archives.
The flaw, in turn, is said to be rooted in another underlying vulnerability (CVE-2015-1197) that was first disclosed in early 2015, which according to Flashpoint was rectified, only to be subsequently reverted in later Linux distributions.
"An attacker can use cpio package to gain incorrect access to any other user accounts," Zimbra said in an advisory published last week, adding it "recommends pax over cpio."
Fixes are available in the following versions -
All an adversary seeking needs to do to weaponize the shortcoming is to send an email with a specially crafted TAR archive attachment that, upon being received, gets submitted to Amavis, which uses the cpio module to trigger the exploit.
Cybersecurity company Kaspersky has disclosed that unknown APT groups have actively been taking advantage of the flaw in the wild, with one of the actors "systematically infecting all vulnerable servers in Central Asia."
The attacks, which unfolded over two attack waves in early and late September, primarily targeted government entities in the region, abusing the initial foothold to drop web shells on the compromised servers for follow-on activities.
Based on information shared by incident response firm Volexity, roughly 1,600 Zimbra servers are estimated to have been infected in what it calls a "mix of targeted and opportunistic attacks."
"Some web shell paths [...] were used in targeted (likely APT) exploitation of key organizations in government, telecommunications, and IT, predominantly in Asia; others were used in massive worldwide exploitation," the company said in a series of tweets.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2022/10/zimbra-releases-patch-for-actively.html