EXECUTIVE SUMMARY:
A recent remote code execution vulnerability in Zimbra email servers, designated CVE-2024-45519, is under active exploitation. This flaw impacts Zimbra’s postjournal service, which handles SMTP traffic. Attackers can exploit the vulnerability by sending malicious emails to the server with specially crafted commands in the CC field. When processed, these commands execute on the server, installing a webshell that allows attackers full access to the compromised system. The attacks are characterized as widespread, leveraging spoofed Gmail accounts, and embedding base64-encoded commands that execute via the 'sh' shell, ultimately establishing a persistent webshell for ongoing server access. The webshell allows attackers to upload files, execute commands, and potentially spread further into internal networks. Researchers provided a proof-of-concept and analyzed Zimbra’s recent patch, finding that replacing the vulnerable 'popen' function with 'execvp' mitigates the issue by adding input sanitization.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A recent remote code execution vulnerability in Zimbra email servers, designated CVE-2024-45519, is under active exploitation. This flaw impacts Zimbra’s postjournal service, which handles SMTP traffic. Attackers can exploit the vulnerability by sending malicious emails to the server with specially crafted commands in the CC field. When processed, these commands execute on the server, installing a webshell that allows attackers full access to the compromised system. The attacks are characterized as widespread, leveraging spoofed Gmail accounts, and embedding base64-encoded commands that execute via the 'sh' shell, ultimately establishing a persistent webshell for ongoing server access. The webshell allows attackers to upload files, execute commands, and potentially spread further into internal networks. Researchers provided a proof-of-concept and analyzed Zimbra’s recent patch, finding that replacing the vulnerable 'popen' function with 'execvp' mitigates the issue by adding input sanitization.[emaillocker id="1283"]
Upgrading to the latest Zimbra patch is essential to prevent exploitation of CVE-2024-45519, which grants attackers full server access via remote code execution. Users should also consider additional safeguards, such as disabling unnecessary services and securing network configurations.
RECOMMENDATION:
We strongly recommend you update Zimbra products to below versions:
REFERENCES:
The following reports contain further technical details: https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-exploited-to-backdoor-servers-using-emails/
[/emaillocker]