PT-2022-23765 · Zimbra · Zimbra Collaboration Suite

Nicolas Verdier · Published 2022-08-11 · Updated 2022-08-16 · CVE-2022-37041

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.8.15 through 9.0

Description An issue was discovered in ProxyServlet.java in the /proxy servlet. The value of the X-Forwarded-Host header overwrites the value of the Host header in proxied requests. The value of the X-Forwarded-Host header is not checked against the whitelist of hosts that ZCS is allowed to proxy to, which is defined by the zimbraProxyAllowedDomains setting.

Recommendations For versions 8.8.15 through 9.0, consider restricting the X-Forwarded-Host header to only allow trusted hosts, as defined in the zimbraProxyAllowedDomains setting, to prevent unauthorized proxy requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-37041

Affected Products

Zimbra Collaboration Suite

References · 5

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37041 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37041 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://t.me/cibsecurity/48059 · Telegram Post