Zimbra Collaboration - RCE (CVE-2022-37042)
Description
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
psychologyCrowdSec Analysis
CVE-2022-37042 is a critical vulnerability in Zimbra Collaboration Suite that allows unauthenticated attackers to exploit the mboximport functionality and upload arbitrary files, potentially leading to directory traversal and remote code execution.
CrowdSec has been tracking this vulnerability and its exploits since 18th of August 2022.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2022-37042 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-37042 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-37042 is currently experiencing high visibility and active exploitation across the internet.
Observed exploitation attempts typically focus on URLs containing /service/extension/backup/mboximport with references to privileged accounts.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2022-08-11 |
| CISA KEV | 2022-08-11 |
| Rule Released | 2022-08-18 |
| CrowdSec First Seen | 2022-08-18 |
| CISA Remediation Deadline | 2022-09-01 |
Related Weaknesses
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.