PT-2022-4906 · Zimbra · Zimbra Collaboration

Yeak Nai Siew · Published 2022-09-07 · Updated 2026-01-10 · CVE-2022-41352

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 8.8.15 and 9.0

Description An issue exists in Zimbra Collaboration (ZCS) that allows an attacker to upload arbitrary files through amavis via a cpio loophole. This loophole involves extracting files to the /opt/zimbra/jetty/webapps/zimbra/public directory, potentially leading to unauthorized access to other user accounts. Reports indicate ongoing exploitation of this issue in the wild. The vulnerability stems from the use of the cpio archiving utility, and Zimbra recommends using pax instead. While pax is a prerequisite for Zimbra on Ubuntu, it is not a default installation on Red Hat Enterprise Linux (RHEL) or CentOS versions 6 and later. Once installed, amavis automatically prioritizes pax over cpio.

Recommendations For Zimbra Collaboration (ZCS) version 8.8.15, install pax to replace cpio as the preferred archiving utility. For Zimbra Collaboration (ZCS) version 9.0, install pax to replace cpio as the preferred archiving utility.

Exploit

Fix

Path traversal

Unrestricted File Upload

Weakness Enumeration

CWE-22

CWE-434

Related Identifiers

BDU:2022-06069

CVE-2022-41352

Affected Products

Zimbra Collaboration

References · 44

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_cpio_cve_2022_41352.rb · Exploit
• 🔥 https://github.com/Cr4ckC4t/cve-2022-41352-zimbra-rce · Exploit
• 🔥 https://github.com/segfault-it/cve-2022-41352 · Exploit
• 🔥 http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html · Exploit
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41352 · Security Note
• https://forums.zimbra.org/viewtopic.php?t=71153&p=306532 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41352 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06069 · Security Note
• https://vuldb.com/ru/?id.209541 · Note
• https://twitter.com/DefusedCyber/status/1975144933624279229 · Twitter Post
• https://t.me/aptreports/16142 · Telegram Post
• https://t.me/proxy_bar/1190 · Telegram Post
• https://t.me/true_secator/3535 · Telegram Post
• https://twitter.com/securityRSS/status/1889729945645072577 · Twitter Post