PT-2021-20841 · Zimbra · Zimbra Collaboration Suite

Simon Scannell · Published 2021-07-02 · Updated 2021-09-20 · CVE-2021-35209

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.0 through 8.8.15 Patch 22 Zimbra Collaboration Suite versions 9.0.0 through 9.0.0 Patch 15

Description: An issue was discovered in ProxyServlet.java in the /proxy servlet. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to, which is defined by the zimbraProxyAllowedDomains setting.

Recommendations: For Zimbra Collaboration Suite versions 8.8.0 through 8.8.15 Patch 22, update to version 8.8.15 Patch 23 or later. For Zimbra Collaboration Suite versions 9.0.0 through 9.0.0 Patch 15, update to version 9.0.0 Patch 16 or later. As a temporary workaround, consider restricting the X-Host header to only allow trusted hosts until a patch is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-35209

Affected Products

Zimbra Collaboration Suite

References · 10

• 🔥 https://blog.sonarsource.com/zimbra-webmail-compromise-via-email · Exploit
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35209 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35209 · Vendor Advisory
• https://t.me/cvenotify/17249 · Telegram Post
• https://t.me/cvenotify/17025 · Telegram Post
• https://t.me/cvenotify/18504 · Telegram Post