Unpatched Zimbra Collaboration Suite RCE CVE-2022
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-41352 | Path Traversal Arbitrary File Upload in Synacor Zimbra Collaboration Suite CVE-2022-41352 is an unauthenticated arbitrary file upload flaw in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0, rooted in a path traversal weakness (CWE-22) in how the amavis mail scanner hands archives to the cpio utility. An attacker sends a specially crafted archive via email; cpio follows traversal entries and extracts attacker-controlled files into the web root at /opt/zimbra/jetty/webapps/zimbra/public. Uploaded files in that web-accessible directory can lead to remote code execution and incorrect access to other users' accounts, giving network-level attackers high impact on confidentiality, integrity, and availability (CVSS 9.8). Any ZCS 8.8.15 or 9.0 deployment that processes mail with cpio is affected, particularly on Red Hat/CentOS 7 and later where the pax utility (which Zimbra recommends as the safe alternative) is not installed by default. The flaw is actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities Catalog on 2022-10-20 with known ransomware use, carries a 95.5% EPSS score, and public reporting ties Zimbra exploitation to campaigns including Russia-linked Sandworm/Seashell Blizzard access operations. Do: Apply updates per vendor instructions, and as an immediate mitigation install the pax package on the Zimbra host (amavis automatically prefers pax over cpio once it is present; note pax is not in default Red Hat installations after RHEL/CentOS 6, while it is a prerequisite on Ubuntu). Also inspect /opt/zimbra/jetty/webapps/zimbra/public for unexpected uploaded files and review mail flow logs for suspicious archive attachments, given confirmed in-the-wild and ransomware-related exploitation. | 9.8 | 95% | KEV ransomware PoC |
| largetens of thousands of internet-exposed Zimbra servers (public scan counts have shown roughly 40,000-60,000 exposed instances) |
Full article706 words · extracted from securityaffairs.com · click to collapse
Threat actors are exploiting an unpatched severe remote code execution flaw (CVE-2022-41352) in the Zimbra collaboration platform.
Researchers from Rapid7 are warning of the exploitation of unpatched zero-day remote code execution vulnerability, tracked as CVE-2022-41352, in the Zimbra Collaboration Suite.
Rapid7 has published technical details, including a proof-of-concept (PoC) code and indicators of compromise (IoCs) regarding CVE-2022-41352 on AttackerKB.
The bad news is that the vulnerability has yet to be patched by the company, the issue has been rated as CVSS 9.8.
“CVE-2022-41352 is an unpatched remote code execution vulnerability in Zimbra Collaboration Suite discovered in the wild due to active exploitation.” reported Rapid7. “The vulnerability is due to the method (cpio) in which Zimbra’s antivirus engine (Amavis) scans inbound emails. Zimbra has provided a workaround, which is to install the pax utility and restart the Zimbra services. Note that pax is installed by default on Ubuntu, so Ubuntu-based Zimbra installations are not vulnerable by default.”
The experts pointed out that the vulnerability is due to the method (cpio) used by Zimbra’s antivirus engine (Amavis) to scan the inbound emails.
According to Zimbra users, the vulnerability is actively exploited since early September 2020. Threat actors are exploiting the issue to upload jsp files into Web Client /public directory by simply sending in an email with a malicious attachment.
“We have an incident where the attacker managed to upload jsp files into Web Client /public directory by simply sending in an email with malicious attachment.” a user wrote on the Zimbra forum.
“Our system already patched to P26 on Zimbra 9. The incident timeline and steps:
- Send a malicious file to one of the user. The amavisd will process this file and I think via cpio loophole, got the file extracted into the target folder /opt/zimbra/jetty/webapps/zimbra/public.
- The attacker access this file (webshell) via the public and executed “zmprov gdpak” to generate preauth and login into any user they targeted.
- They login to [email protected] account to delete the file they sent in via step1 to try erase the trail.”
Zimbra is urging users to install the “pax” utility and restart the Zimbra services to avoid the Amavis component falling back to using cpio.
“All Zimbra administrators should make sure the pax package is installed on their Zimbra server. Pax is needed by Amavis to extract the contents of compressed attachments for virus scanning.” reads an update published by the company. “If the pax package is not installed, Amavis will fall-back to using cpio, unfortunately the fall-back is implemented poorly (by Amavis) and will allow an unauthenticated attacker to create and overwrite files on the Zimbra server, including the Zimbra webroot.
For most Ubuntu servers the pax package should already be installed as it is a dependency of Zimbra. Due to a packaging change in CentOS, there is a high chance pax is not installed.”
Summarizing, the flaw can be exploitable if these two conditions are met:
- A vulnerable version of cpio must be installed, which is the case on basically every system (see CVE-2015-1197) (see CVE-2015-1197)
- The pax utility must not be installed, as Amavis prefers pax and pax is not vulnerable
Rapid7 researchers pointed out that pax is not installed by default on Red Hat-based distros, this means that they are vulnerable by default. Below is the list of Linux distros tested by Rapid7:
| Linux Distro | Vulnerable? |
|---|---|
| Oracle Linux 8 | Vulnerable |
| Red Hat Enterprise Linux 8 | Vulnerable |
| Rocky Linux 8 | Vulnerable |
| CentOS 8 | Vulnerable |
| Ubuntu 20.04 | Not vulnerable (pax is installed by default) |
| Ubuntu 18.04 | Not vulnerable (pax is installed, cpio has Ubuntu’s custom patch) |
Zimbra is going to address it by removing the dependency on cpio by making pax a prerequisite for Zimbra Collaboration Suite.
“Since cpio has no mode where it can be securely used on untrusted files, the attacker can write to any path on the filesystem that the Zimbra user can access. The most likely outcome is for the attacker to plant a shell in the web root to gain remote code execution, although other avenues likely exist.” concludes Rapid7.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Zimbra)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/136800/hacking/zimbra-rce-cve-2022-41352.html