CVE-2022-41352

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Zimbra Collaboration Suite

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis…

26. Sep 2022

Ausgewertete Quellen

• Hersteller
  https://forums.zimbra.org/viewtopic.php?t=71153&p=306532
• Hersteller
  https://wiki.zimbra.com/wiki/Security_Center
• Hersteller
  https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• Hinweis
  http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
• Hinweis
  https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41352
• CISA
  Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
• NVD
  CVE-2022-41352