Zimbra Collaboration - Unrestricted File Upload

Exploited in the wild. Listed by CISA on 2022-10-20; known to be used by ransomware.

criticalseverity

9.8CVSS score

95.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

Impact

Unauthenticated attackers can upload arbitrary files through amavis via a cpio loophole that extracts to the webapps directory, potentially achieving remote code execution and unauthorized access to other user accounts in Zimbra Collaboration Suite.

Fix

Install pax package and ensure amavis is configured to use pax instead of cpio. Update to the latest patched version of Zimbra Collaboration Suite.

How to confirm it

Send: GET {{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js
Positive when: contains "Zimbra Collaboration Suite Web Client" AND contains in content_type "application/x-javascript" AND contains "8.8.15" or "9.0"

Run it with nuclei: nuclei -id CVE-2022-41352 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-41352

info:
  name: Zimbra Collaboration - Unrestricted File Upload
  author: rxerium
  severity: critical
  description: |
    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
  impact: |
    Unauthenticated attackers can upload arbitrary files through amavis via a cpio loophole that extracts to the webapps directory, potentially achieving remote code execution and unauthorized access to other user accounts in Zimbra Collaboration Suite.
  remediation: |
    Install pax package and ensure amavis is configured to use pax instead of cpio. Update to the latest patched version of Zimbra Collaboration Suite.
  reference:
    - https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-41352
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-41352
    cwe-id: CWE-22
    epss-score: 0.95478
    epss-percentile: 0.9987
    cpe: cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zimbra
    product: collaboration
    shodan-query:
      - http.favicon.hash:"1624375939"
      - http.html:"Zimbra Collaboration Suite Web Client"
    fofa-query: icon_hash="1624375939"
  tags: cve,cve2022,zimbra,kev,file-upload,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Zimbra Collaboration Suite Web Client"

      - type: word
        part: content_type
        words:
          - "application/x-javascript"

      - type: word
        part: body
        words:
          - "8.8.15"
          - "9.0"
        condition: or

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'CLIENT_VERSION",\s*{type:ZmSetting\.T_CONFIG,\s*defaultValue:"(.*?)"'

References

Use this check only on systems you are authorised to test. Where the data comes from