Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal

Exploited in the wild. Listed by CISA on 2022-08-11; known to be used by ransomware.

highseverity

7.2CVSS score

98.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Impact

An administrator-authenticated attacker uploads a ZIP whose entries traverse out of the extraction directory, dropping a JSP webshell into the Zimbra webroot for remote code execution as the zimbra user - and CVE-2022-37042 removes the authentication requirement entirely, which is how this pair was mass-exploited in the wild.

Fix

Apply Zimbra Collaboration 8.8.15 Patch 31 or 9.0.0 Patch 24 (both released 2022-03-30) or later, which also requires the CVE-2022-37042 fix in 8.8.15 Patch 33 / 9.0.0 Patch 26 to close the authentication bypass on the same mboximport endpoint.

How to confirm it

Send: GET {{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js
Positive when: contains "Zimbra Collaboration Suite Web Client" AND contains in header "application/x-javascript" AND contains in version "8.8.15" or "9.0" AND status 200

Run it with nuclei: nuclei -id CVE-2022-27925 -u <target>

The full check

id: CVE-2022-27925

info:
  name: Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal
  author: popy21
  severity: high
  description: |
    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
  impact: |
    An administrator-authenticated attacker uploads a ZIP whose entries traverse out of the extraction directory, dropping a JSP webshell into the Zimbra webroot for remote code execution as the zimbra user - and CVE-2022-37042 removes the authentication requirement entirely, which is how this pair was mass-exploited in the wild.
  remediation: |
    Apply Zimbra Collaboration 8.8.15 Patch 31 or 9.0.0 Patch 24 (both released 2022-03-30) or later, which also requires the CVE-2022-37042 fix in 8.8.15 Patch 33 / 9.0.0 Patch 26 to close the authentication bypass on the same mboximport endpoint.
  reference:
    - http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html
    - https://wiki.zimbra.com/wiki/Security_Center
    - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
    - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P31
    - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
    - https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27925
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2022-27925
    cwe-id: CWE-22
    epss-score: 0.98676
    epss-percentile: 0.99924
    cpe: cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: synacor
    product: zimbra_collaboration_suite
    shodan-query: http.title:"Zimbra Collaboration Suite"
    fofa-query: title="Zimbra Collaboration Suite"
  tags: cve,cve2022,synacor,zimbra,zimbra-collaboration-suite,lfi,rce,kev,vkev,passive

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Zimbra Collaboration Suite Web Client"

      - type: word
        part: header
        words:
          - "application/x-javascript"

      - type: word
        part: version
        words:
          - "8.8.15"
          - "9.0"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - 'CLIENT_VERSION\",\s+{type:ZmSetting.T_CONFIG, defaultValue:\"(.*?)"'

References

Use this check only on systems you are authorised to test. Where the data comes from