Threat Advisory

Critical Zimbra RCE Vulnerability Allows Attackers Remote Code Execution

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

A recent remote code execution vulnerability in Zimbra email servers, designated CVE-2024-45519, is under active exploitation. This flaw impacts Zimbra’s postjournal service, which handles SMTP traffic. Attackers can exploit the vulnerability by sending malicious emails to the server with specially crafted commands in the CC field. When processed, these commands execute on the server, installing a webshell that allows attackers full access to the compromised system. The attacks are characterized as widespread, leveraging spoofed Gmail accounts, and embedding base64-encoded commands that execute via the 'sh' shell, ultimately establishing a persistent webshell for ongoing server access. The webshell allows attackers to upload files, execute commands, and potentially spread further into internal networks. Researchers provided a proof-of-concept and analyzed Zimbra’s recent patch, finding that replacing the vulnerable 'popen' function with 'execvp' mitigates the issue by adding input sanitization.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

A recent remote code execution vulnerability in Zimbra email servers, designated CVE-2024-45519, is under active exploitation. This flaw impacts Zimbra’s postjournal service, which handles SMTP traffic. Attackers can exploit the vulnerability by sending malicious emails to the server with specially crafted commands in the CC field. When processed, these commands execute on the server, installing a webshell that allows attackers full access to the compromised system. The attacks are characterized as widespread, leveraging spoofed Gmail accounts, and embedding base64-encoded commands that execute via the 'sh' shell, ultimately establishing a persistent webshell for ongoing server access. The webshell allows attackers to upload files, execute commands, and potentially spread further into internal networks. Researchers provided a proof-of-concept and analyzed Zimbra’s recent patch, finding that replacing the vulnerable 'popen' function with 'execvp' mitigates the issue by adding input sanitization.[emaillocker id="1283"]

 

  • CVE-2024-45519: A critical remote code execution vulnerability in Zimbra's postjournal service, with a CVSS score of 9.8. Attackers exploit this flaw by injecting malicious commands into the CC field of SMTP emails, leading to unauthorized code execution. Exploited servers face high risks of data theft and further network intrusion.

 

Upgrading to the latest Zimbra patch is essential to prevent exploitation of CVE-2024-45519, which grants attackers full server access via remote code execution. Users should also consider additional safeguards, such as disabling unnecessary services and securing network configurations.

RECOMMENDATION:

We strongly recommend you update Zimbra products to below versions:

REFERENCES:

The following reports contain further technical details: https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-exploited-to-backdoor-servers-using-emails/

[/emaillocker]
crossmenu