Zimbra Collaboration Suite - Memcached Command Injection

Exploited in the wild. Listed by CISA on 2022-08-04; known to be used by ransomware.

highseverity

9.8CVSS score

93.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Zimbra Collaboration Suite versions 8.8.15 and 9.0 contain a memcached command injection vulnerability that allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, leading to cache poisoning and potential credential theft.

Impact

Successful exploitation allows attackers to overwrite arbitrary cached entries and steal user credentials in cleartext without user interaction. With valid credentials, attackers can perform spear phishing, social engineering, and business email compromise attacks, or maintain persistent access via webshells.

Fix

Update to Zimbra Collaboration Suite version 8.8.15 Patch 31 or 9.0.0 Patch 24.1 or later. Implement multi-factor authentication to mitigate credential theft impact.

How to confirm it

Send: GET {{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js
Positive when: contains "Zimbra Collaboration Suite Web Client" AND contains in header "application/x-javascript" AND contains in version "8.8.15" or "9.0" AND status 200

Run it with nuclei: nuclei -id CVE-2022-27924 -u <target>

The full check

id: CVE-2022-27924

info:
  name: Zimbra Collaboration Suite - Memcached Command Injection
  author: rxerium
  severity: high
  description: |
    Zimbra Collaboration Suite versions 8.8.15 and 9.0 contain a memcached command injection vulnerability that allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, leading to cache poisoning and potential credential theft.
  impact: |
    Successful exploitation allows attackers to overwrite arbitrary cached entries and steal user credentials in cleartext without user interaction. With valid credentials, attackers can perform spear phishing, social engineering, and business email compromise attacks, or maintain persistent access via webshells.
  remediation: |
    Update to Zimbra Collaboration Suite version 8.8.15 Patch 31 or 9.0.0 Patch 24.1 or later. Implement multi-factor authentication to mitigate credential theft impact.
  reference:
    - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27924
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-27924
    epss-score: 0.93908
    epss-percentile: 0.99846
    cpe: cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: synacor
    product: zimbra_collaboration_suite
    shodan-query:
      - http.title:"zimbra collaboration suite"
  tags: cve,cve2022,zimbra,injection,passive,vuln,kev,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Zimbra Collaboration Suite Web Client"

      - type: word
        part: header
        words:
          - "application/x-javascript"

      - type: word
        words:
          - "8.8.15"
          - "9.0"
        part: version

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'CLIENT_VERSION\",\s+{type:ZmSetting.T_CONFIG, defaultValue:\"(.*?)"'

References

Use this check only on systems you are authorised to test. Where the data comes from