Security Experts:

Zimbra Patches Under-Attack Code Execution Bug

Messaging and collaboration software maker Zimbra has rushed out patches to provide cover for a code execution flaw that has already been exploited to plant malware on target machines.

The Zimbra patches come more than a week after malware hunters at Rapid7 spotted signs of zero-day exploits hitting the Zimbra Collaboration (ZCS) suite.

The vulnerability, tracked as CVE-2022-41352, allows an attacker to plant a shell in the web root and achieve remote code execution.  The bug carries a CVSS severity score of 9.8/10 and could allow an attacker to use the cpio package to gain incorrect access to any other user accounts.

[ READ: Zoom for macOS Contains High-Risk Security Flaw ]

The company had previously issued a workaround recommending pax over cpio and acknowledged that an attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. 

The new Zimbra security updates also cover a medium-severity bug (CVE-2022-37393) with a CVSS score of 7.8/10.  “Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters,” the company said in its documentation.

Zimbra patched multiple cross-site scripting (XSS) flaws that expose webmail users to information disclosure attacks.

The CVE-2022-41352 bug was identified in early September, after users started complaining of threat actors already launching exploits in live attacks.

Related: Critical Zimbra RCE Vulnerability Exploit as Zero-Day

Related: Zero-Day Vulnerability Exploited to Hack Over 1,000 Zimbra Email Servers

Related: Zimbra Credential Theft Vulnerability Exploited in Attacks 

view counter
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. Ryan is a veteran cybersecurity strategist who has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan's past career as a security journalist included bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive's ZDNet, PCMag and PC World. Ryan is a director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world. Follow Ryan on Twitter @ryanaraine.