Zimbra Collaboration - Cross-Site Scripting (XSS)

id: CVE-2024-27443

info:
  name: Zimbra Collaboration - Cross-Site Scripting (XSS)
  author: rxerium
  severity: medium
  description: |
    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload.
  impact: |
    Unauthenticated attackers can execute arbitrary JavaScript via crafted calendar headers in emails, potentially stealing user credentials or session data.
  remediation: |
    Update Zimbra Collaboration to version 9.0.0 P39 or 10.0.7 or later.
  reference:
    - https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes
    - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27443
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2024-27443
    cwe-id: CWE-79
    epss-score: 0.24606
    epss-percentile: 0.97899
    cpe: cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: zimbra
    product: collaboration
    shodan-query:
      - http.favicon.hash:"1624375939"
      - http.html:"zimbra collaboration suite web client"
      - http.favicon.hash:"475145467"
    fofa-query:
      - icon_hash="1624375939"
      - app="zimbra-邮件系统"
      - body="zimbra collaboration suite web client"
      - icon_hash="475145467"
  tags: cve,cve2024,zimbra,kev,passive,xss,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Zimbra Collaboration"

      - type: word
        part: content_type
        words:
          - "application/x-javascript"

      - type: dsl
        dsl:
          - compare_versions(version, '9.0.0')
          - compare_versions(version, '>= 10.0.0', '< 10.0.7')
        condition: or

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - CLIENT_VERSION\",\s+{type:ZmSetting\.T_CONFIG, defaultValue:"([0-9.]+)_([A-Z_0-9]+)"\}