Threat Signal Report

Joint CyberSecurity Advisory on Vulnerabilities in Zimbra Collaboration (CISA-MS-ISAC)

description-logo Description

On August 16th, a joint cybersecurity advisory was issued by the Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) on vulnerabilities in Zimbra Collaboration that is actively leveraged in the field by threat actors. The advisory covers five CVEs: CVE-2022-24682, CVE-2022-27924, CVE-2022-27925, CVE-2022-37042, and CVE-2022-30333.


Why is this Significant?

This is significant because the vulnerabilities in Zimbra Collaboration Suite called out in the advisory (CVE-2022-24682, CVE-2022-27924, CVE-2022-27925, CVE-2022-37042, and CVE-2022-30333) are leveraged in real attacks by threat actors, and as such relevant patches should be applied as soon as possible.


Zimbra Collaboration, formerly known as Zimbra Collaboration Suite, is a cloud-based email, calendaring, and groupware solution developed by Synacor and is widely used worldwide. According to its Web site, Zimbra is used in more than 140 countries and over 1,000 government and financial institutions.


How Widespread are the Attacks Leveraging the Vulnerabilities?

While there is no information available as to how widespread the attacks are, wide adoption of Zimbra Collaboration is a high exploitation target for any threat actor.


What are the Vulnerabilities Exploited in the Field?

The advisory states a total of five vulnerabilities are exploited in the wild.


  • CVE-2022-24682

CVE-2022-24682 is a cross-site scripting (XSS) vulnerability in Zimbra Webmail. The vulnerability affects all versions of Zimbra 8.8.15 and was exploited as a zero-day. Remote attackers can leverage the vulnerability to run an arbitrary web script within the session of the connected Zimbra user.


  • CVE-2022-27924

CVE-2022-27924 is a memcache command injection vulnerability that impacts Zimbra Collaboration 8.8.15 and 9.0. Successful exploitation allows a remote attacker to steal email login credentials in plain text from Zimbra Collaboration without any user interaction.


  • CVE-2022-27925

CVE-2022-27925 is an arbitrary file upload vulnerability that affects Zimbra Collaboration 8.8.15 and 9.0. By leveraging the vulnerability, an authenticated remote attacker can upload arbitrary files to an arbitrary location on the vulnerable system. The advisory states that CVE-2022-27925 was observed to have been exploited in conjunction with CVE-2022-37042.


  • CVE-2022-37042

CVE-2022-37042 is an authentication bypass vulnerability that impacts Zimbra Collaboration 8.8.15 and 9.0. Successful exploitation allows an unauthenticated attacker to upload arbitrary files to an arbitrary location on the vulnerable system and leads to remote code execution. The advisory states that CVE-2022-37042 was observed to have been exploited in conjunction with CVE-2022-27925.


  • CVE-2022-30333

CVE-2022-30333 is a path traversal vulnerability that affects Linux and Unix versions of RARLAB UnRAR before version 6.12. Successfully exploiting the vulnerability allows an attacker to drop files to an arbitrary location on a vulnerable system during the unpacking operation.



Has the Vendor Released a Patch?

Yes. A patch is available for all vulnerabilities. For more details, see the Appendix for a link to "Zimbra Collaboration - Security Vulnerability Advisories" and "RARLAB".


What is the Status of Coverage?

FortiGuard Labs has the following IPS coverage in place against the exploitation of the vulnerabilities:


  • Zimbra.Collaboration.Calendar.Reflected.XSS (CVE-2022-24682)
  • Zimbra.Collaboration.Mboximport.Unrestricted.File.Upload (CVE-2022-27925 and CVE-2022-37042)
  • Zimbra.Collaboration.Memcached.CRLF.Injection (CVE-2022-27924)
  • RARLAB.UnRAR.ExtractUnixLink50.Directory.Traversal (CVE-2022-30333) - default action is set to "pass"

Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.