Zimbra - Cross-Site Scripting via ICS Files

Exploited in the wild. Listed by CISA on 2025-10-07; known to be used by ransomware.

mediumseverity

5.4CVSS score

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event inside a details tag, allowing attackers to perform unauthorized actions like email redirection and data exfiltration.

Impact

Authenticated users viewing malicious ICS files can have JavaScript executed in their browser context through stored XSS, potentially leading to session hijacking and data exfiltration.

Fix

Upgrade to Zimbra Collaboration Suite version 9.0.1, 10.0.13, or 10.1.5 or later that properly sanitizes HTML content in ICS files.

How to confirm it

Send: GET {{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js
Positive when: contains "Zimbra Collaboration Suite" AND contains in header "application/x-javascript" AND compare_versions(version, '9.0.0') or compare_versions(version, '>= 10.0.0', '< 10.0.13') or compare_versions(version, '>= 10.1.0', '< 10.1.5')

Run it with nuclei: nuclei -id CVE-2025-27915 -u <target>

The full check

id: CVE-2025-27915

info:
  name: Zimbra - Cross-Site Scripting via ICS Files
  author: Snbig,EhsanCreator,eliotworkspac-max
  severity: medium
  description: |
    Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event inside a details tag, allowing attackers to perform unauthorized actions like email redirection and data exfiltration.
  impact: |
    Authenticated users viewing malicious ICS files can have JavaScript executed in their browser context through stored XSS, potentially leading to session hijacking and data exfiltration.
  remediation: |
    Upgrade to Zimbra Collaboration Suite version 9.0.1, 10.0.13, or 10.1.5 or later that properly sanitizes HTML content in ICS files.
  reference:
    - https://wiki.zimbra.com/wiki/Security_Center
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27915
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2025-27915
    cwe-id: CWE-79
    epss-score: 0.04064
    epss-percentile: 0.90753
  metadata:
    max-request: 1
    verified: true
    vendor: zimbra
    product: collaboration
    fofa-query: title="Zimbra Collaboration Suite"
    shodan-query: http.title:"Zimbra Collaboration Suite"
  tags: cve,cve2025,zimbra,xss,ics,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Zimbra Collaboration Suite"

      - type: word
        part: header
        words:
          - "application/x-javascript"

      - type: dsl
        dsl:
          - compare_versions(version, '9.0.0')
          - compare_versions(version, '>= 10.0.0', '< 10.0.13')
          - compare_versions(version, '>= 10.1.0', '< 10.1.5')
        condition: or

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - CLIENT_VERSION\",\s+{type:ZmSetting\.T_CONFIG, defaultValue:"([0-9.]+)_([A-Z_0-9]+)"\}

References

Use this check only on systems you are authorised to test. Where the data comes from