CVE-2022-41352criticalunder attackransomwareCWE-22

CVE-2022-41352

Published · Updated

Follow this CVE+ Monitor Zimbra Collaboration Suite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 95%
from disclosure to weapon14 days
Published on NVDSep 26
1st PoC+14d
metasploitJun 28
CISA KEV+24d
Action required by CISAfederal deadline: 2022-11-10

Apply updates per vendor instructions.

In short

Zimbra Collaboration has a vulnerability that allows attackers to upload malicious files through the email scanning system (amavis), which can then be accessed by other users. This happens because of a flaw in how files are extracted and stored, potentially giving attackers access to other people's accounts.

Technical detail

CVE-2022-41352 exploits a path traversal vulnerability (CWE-22) in amavis integration where cpio extraction to /opt/zimbra/jetty/webapps/zimbra/public allows arbitrary file upload and placement, enabling unauthorized access to other user accounts. Exploitation requires the ability to send crafted email attachments through amavis; remediation involves switching from cpio to pax for archive extraction.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.