Headline
Zimbra RCE Bug Under Active Attack
A flaw in unpatched Zimbra email servers could allow attackers to obtain remote code execution by pushing malicious files past filters.
Administrators running Zimbra servers are being warned to update their systems with the “pax” utility by researchers, who have observed cyberattackers actively attempting to exploit a known flaw.
Zimbra is a cloud-hosted email and employee collaboration platform. The bug, being tracked as CVE-2022-41352, exists in the virus-scan process for incoming emails; it could allow malicious files to get through, ultimately leading to remote code execution (RCE).
Synacor, the development company behind Zimbra, issued an alert to users on Sept. 14, warning admins they needed to install the pax package against the vulnerability,
Now, Rapid7 researchers said in a blog post that they have observed active exploitation of the flaw in the wild, and urged administrators who haven’t already, to update their systems.
Synacor added that Ubuntu users should have already had the pax package installed automatically.
“The vulnerability is due to the method (cpio) in which Zimbra’s antivirus engine (Amavis) scans inbound emails,” the Rapid7 team explained in an Oct. 6 blog post. “Zimbra has provided a workaround, which is to install the pax utility and restart the Zimbra services.”
Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Subscribe
Related news
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component.
Plus: Important patches from Apple, VMWare, Cisco, Zimbra, SAP, and Oracle.
This Metasploit module creates a .tar file that can be emailed to a Zimbra server to exploit CVE-2022-41352. If successful, it plants a JSP-based backdoor in the public web directory, then executes that backdoor. The core vulnerability is a path-traversal issue in the cpio command-line utility that can extract an arbitrary file to an arbitrary location on a Linux system (CVE-2015-1197). Most Linux distros have chosen not to fix it. This issue is exploitable on Red Hat-based systems (and other hosts without pax installed) running versions Zimbra Collaboration Suite 9.0.0 Patch 26 and below and Zimbra Collaboration Suite 8.8.15 Patch 33 and below.
Zimbra has released patches to contain an actively exploited security flaw in its enterprise collaboration suite that could be leveraged to upload arbitrary files to vulnerable instances. Tracked as CVE-2022-41352 (CVSS score: 9.8), the issue affects a component of the Zimbra suite called Amavis, an open source content filter, and more specifically, the cpio utility it uses to scan and extract
Mitigation guidance provided while a patch is being developed
A severe remote code execution vulnerability in Zimbra's enterprise collaboration software and email platform is being actively exploited, with no patch currently available to remediate the issue. The shortcoming, assigned CVE-2022-41352, carries a critical-severity rating of CVSS 9.8, providing a pathway for attackers to upload arbitrary files and carry out malicious actions on affected