Zimbra urges customers to manually fix actively exploited zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-27925 | Authenticated Path Traversal File Upload Leading to RCE in Zimbra Collaboration Suite CVE-2022-27925 is a directory traversal flaw (CWE-22) in the mailbox import (mboximport) functionality of Synacor Zimbra Collaboration Suite (ZCS), which accepts a ZIP archive and extracts files from it without properly validating paths. An authenticated user with administrator rights can trigger the flaw by submitting a malicious ZIP archive, causing arbitrary files to be written outside the intended directory. By planting attacker-controlled files in arbitrary locations, an attacker can achieve remote code execution on the server. All organizations running ZCS 8.8.15 or 9.0 are potentially affected, and the flaw has been mass-exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-11, ordered civilian agencies to patch it, and ransomware operators and other actors are known to be using it. Do: Apply the vendor's updates/patches for ZCS 8.8.15 and 9.0 as instructed by Zimbra, per CISA's required action. Limit external access to Zimbra's mailbox import/administration endpoints to trusted networks only, and hunt for indicators of compromise such as unexpected files or webshells in the Zimbra web root, unusual admin activity, and signs of follow-on ransomware deployment. | 7.2 | 99% | KEV ransomware PoC |
| largetens of thousands of internet-exposed Zimbra servers serving an estimated hundreds of thousands of users (vendor claims 200,000+ organizational customers) | |
| CVE-2022-41352 | Path Traversal Arbitrary File Upload in Synacor Zimbra Collaboration Suite CVE-2022-41352 is an unauthenticated arbitrary file upload flaw in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0, rooted in a path traversal weakness (CWE-22) in how the amavis mail scanner hands archives to the cpio utility. An attacker sends a specially crafted archive via email; cpio follows traversal entries and extracts attacker-controlled files into the web root at /opt/zimbra/jetty/webapps/zimbra/public. Uploaded files in that web-accessible directory can lead to remote code execution and incorrect access to other users' accounts, giving network-level attackers high impact on confidentiality, integrity, and availability (CVSS 9.8). Any ZCS 8.8.15 or 9.0 deployment that processes mail with cpio is affected, particularly on Red Hat/CentOS 7 and later where the pax utility (which Zimbra recommends as the safe alternative) is not installed by default. The flaw is actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-10-20 with known ransomware use, carries a 95.5% EPSS score, and public reporting ties Zimbra exploitation to campaigns including Russia-linked Sandworm/Seashell Blizzard access operations. Do: Apply updates per vendor instructions, and as an immediate mitigation install the pax package on the Zimbra host (amavis automatically prefers pax over cpio once it is present; note pax is not in default Red Hat installations after RHEL/CentOS 6, while it is a prerequisite on Ubuntu). Also inspect /opt/zimbra/jetty/webapps/zimbra/public for unexpected uploaded files and review mail flow logs for suspicious archive attachments, given confirmed in-the-wild and ransomware-related exploitation. | 9.8 | 95% | KEV ransomware PoC |
| largetens of thousands of internet-exposed Zimbra servers (public scan counts have shown roughly 40,000-60,000 exposed instances) |
Full article550 words · extracted from securityaffairs.com · click to collapse
Zimbra has released updates to address a zero-day vulnerability actively exploited in attacks aimed at Zimbra Collaboration Suite (ZCS) email servers.
Zimbra urges customers to manually install updates to fix a zero-day vulnerability that is actively exploited in attacks against Zimbra Collaboration Suite (ZCS) email servers.
Zimbra Collaboration Suite is a comprehensive open-source messaging and collaboration platform that provides email, calendaring, file sharing, and other collaboration tools. It was developed by Zimbra, Inc..
Zimbra offers both on-premises and cloud-based solutions.
Zimbra is an email and collaboration platform used by more than 200,000 businesses from over 140 countries.
“A security vulnerability in Zimbra Collaboration Suite Version 8.8.15 that could potentially impact the confidentiality and integrity of your data has surfaced.” reads the advisory published by the company. “The issue has been fixed. We have also performed rigorous testing to ensure the effectiveness and stability of the system. The fix is planned to be delivered in the July patch release.”
The vulnerability is reflected Cross-Site Scripting (XSS) that was discovered by Clément Lecigne of Google Threat Analysis Group (TAG). Google TAG researchers focus on identifying and countering advanced and persistent threats. The primary task of the Google TAG is to investigate and mitigate targeted and sophisticated cyber threats, including state-sponsored hacking and hacking groups involved in coordinated attacks.
Almost any vulnerability reported by Google TAG in the past was part of exploits used by APT groups in targeted attacks. The popular security researcher Maddie Stone from Google TAG confirmed that this issue was used by an APT group too:
.@_clem1 discovered this being used in-the-wild in a targeted attack. Thank you to @Zimbra for publishing this advisory and mitigation advice! If you run Zimbra Collaboration Suite, please go manually apply the fix! #itw0days https://t.co/lqwt0kOFWA
— Maddie Stone (@maddiestone) July 13, 2023
The vulnerability has been fixed by the company that plans to deliver the fix as part of the July patch release, meantime the company is requesting admins to apply the fix manually to all of their mailbox nodes. Below is the step-by-step procedure shared in the advisory:
Steps to apply the fix manually on all of your mailbox nodes
- Take a backup of the file /opt/zimbra/jetty/webapps/zimbra/m/momoveto
- Edit this file and go to line number 40
- Update the parameter value as below
<input name=”st” type=”hidden” value=”${fn:escapeXml(param.st)}”/> - Before the update, the line appeared as below
<input name=”st” type=”hidden” value=”${param.st}”/>
After the update, the line should appear as below
<input name=”st” type=”hidden” value=”${fn:escapeXml(param.st)}”/>
The advisory states that the Zimbra service restart is not required.
In October, researchers from Rapid7 warned of the exploitation of another unpatched zero-day vulnerability, tracked as CVE-2022-41352, in the Zimbra Collaboration Suite.
Rapid7 has published technical details for the RCE issue, including a proof-of-concept (PoC) code and indicators of compromise (IoCs) regarding CVE-2022-41352 on AttackerKB.
According to Zimbra users, the vulnerability is actively exploited since early September 2020. Threat actors are exploiting the issue to upload jsp files into Web Client /public directory by simply sending in an email with a malicious attachment.
In August 2022, US CISA warned that threat actors were exploiting an authentication bypass Zimbra flaw, tracked as CVE-2022-27925, to hack Zimbra Collaboration Suite email servers worldwide.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Zimbra)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/148429/hacking/zimbra-collaboration-suite-zeroday.html