Messaging and collaboration software maker Zimbra has rushed out patches to provide cover for a code execution flaw that has already been exploited to plant malware on target machines.
The Zimbra patches come more than a week after malware hunters at Rapid7 spotted signs of zero-day exploits hitting the Zimbra Collaboration (ZCS) suite.
The vulnerability, tracked as CVE-2022-41352, allows an attacker to plant a shell in the web root and achieve remote code execution. The bug carries a CVSS severity score of 9.8/10 and could allow an attacker to use the cpio package to gain incorrect access to any other user accounts.
[ READ: Zoom for macOS Contains High-Risk Security Flaw ]
The company had previously issued a workaround recommending pax over cpio and acknowledged that an attacker can upload arbitrary files through amavisd via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts.
The new Zimbra security updates also cover a medium-severity bug (CVE-2022-37393) with a CVSS score of 7.8/10. “Zimbra’s sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters,” the company said in its documentation.
Zimbra patched multiple cross-site scripting (XSS) flaws that expose webmail users to information disclosure attacks.
The CVE-2022-41352 bug was identified in early September, after users started complaining of threat actors already launching exploits in live attacks.
Related: Critical Zimbra RCE Vulnerability Exploit as Zero-Day
Related: Zero-Day Vulnerability Exploited to Hack Over 1,000 Zimbra Email Servers
Related: Zimbra Credential Theft Vulnerability Exploited in Attacks