CERT-In Vulnerability Note
CIVN-2022-0325
Multiple Vulnerabilities in Zimbra
Original Issue Date:August 16, 2022
Severity Rating: HIGH
Software Affected
- Zimbra versions prior to 9.0.0 Patch 26
- Zimbra versions prior to 8.8.15 Patch 33
- RARLAB UnRAR prior to 6.12 on Linux and UNIX
Overview
Multiple vulnerabilities have been reported in Zimbra Collaboration which could be exploited by an attacker to execute arbitrary code or bypass security restrictions on the target system.
Description
1. Remote Code Execution Vulnerability
(
CVE-2022-27925
)
This vulnerability exists in Zimbra Collaboration due to improper uploading of file by the mboximport function. An authenticated attacker with admin rights could exploit this vulnerability by executing a specially crafted request to upload arbitrary files.
Successful exploitation of the vulnerability could allow the attacker to traverse directories on the target system.
2. Authentication Bypass Vulnerability
(
CVE-2022-37042
)
This vulnerability exists in Zimbra Collaboration due to improper uploading of file by the mboximport function. A remote attacker could exploit this vulnerability by sending a specially crafted request on the target system.
Successful exploitation of this vulnerability could allow the attacker to bypass security restrictions leading to further attacks.
3. Path Traversal Vulnerability
(
CVE-2022-30333
)
This vulnerability exists in the Unrar utility tool used in Zimbra due to improper limitation of pathname to a restricted directory. A remote attacker, without any authentication could exploit this vulnerability to execute arbitrary code on the target system.
Successful exploitation of this vulnerability could allow the attacker to gain access to sensitive information on the target system.
Note: An unauthenticated remote attacker could exploit the RCE vulnerability CVE-2022-27925 in conjunction with the authentication bypass vulnerability CVE-2022-37042 to execute remote code execution attacks resulting in severe criticality and compromise of the email server.
Solution
Apply appropriate software fixes as available on the vendor website.
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P26
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P33
https://www.rarlab.com/download.htm
Vendor Information
Zimbra
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/
RarLab
https://www.rarlab.com/
References
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/
https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
CVE Name
CVE-2022-27925
CVE-2022-37042
CVE-2022-30333
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|