Zimbra Collaboration Suite < 8.8.15 - Improper Encoding

Exploited in the wild. Listed by CISA on 2022-02-25; known to be used by ransomware.

mediumseverity

6.1CVSS score

30.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Impact

Attackers can inject malicious JavaScript through the Calendar feature that executes in victims' browsers, potentially stealing session tokens and accessing email communications of Zimbra users.

Fix

Update Zimbra Collaboration Suite to version 8.8.15 patch 30 or later that properly escapes HTML in Calendar feature attributes.

How to confirm it

Send: GET {{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js
Positive when: contains "Zimbra Collaboration Suite Web Client" AND contains in content_type "application/x-javascript" AND compare_versions(detected_version, '< 8.8.15') and compare_versions(detected_version, '> 8.7.15')

Run it with nuclei: nuclei -id CVE-2022-24682 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-24682

info:
  name: Zimbra Collaboration Suite < 8.8.15 - Improper Encoding
  author: rxerium
  severity: medium
  description: |
    An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
  impact: |
    Attackers can inject malicious JavaScript through the Calendar feature that executes in victims' browsers, potentially stealing session tokens and accessing email communications of Zimbra users.
  remediation: |
    Update Zimbra Collaboration Suite to version 8.8.15 patch 30 or later that properly escapes HTML in Calendar feature attributes.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24682
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-24682
    epss-score: 0.30931
    epss-percentile: 0.98272
    cwe-id: CWE-116
  metadata:
    max-request: 1
    vendor: zimbra
    product: collaboration
    shodan-query:
      - http.favicon.hash:"1624375939"
      - http.html:"Zimbra Collaboration Suite Web Client"
    fofa-query: icon_hash="1624375939"
  tags: cve,cve2022,zimbra,collaboration,xss,kev,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Zimbra Collaboration Suite Web Client"

      - type: word
        part: content_type
        words:
          - "application/x-javascript"

      - type: dsl
        dsl:
          - "compare_versions(detected_version, '< 8.8.15')"
          - "compare_versions(detected_version, '> 8.7.15')"
        condition: and

    extractors:
      - type: regex
        part: body
        name: detected_version
        group: 1
        regex:
          - CLIENT_VERSION\",\s+{type:ZmSetting\.T_CONFIG, defaultValue:"([0-9.]+)_([A-Z_0-9]+)"\}

References

Use this check only on systems you are authorised to test. Where the data comes from