Pierluigi Paganini August 05, 2022

US Critical Infrastructure Security Agency (CISA) adds a recently disclosed flaw in the Zimbra email suite to its Known Exploited Vulnerabilities Catalog.

The Cybersecurity & Infrastructure Security Agency (CISA) has added a recently disclosed flaw in the Zimbra email suite, tracked as CVE-2022-27924, to its Known Exploited Vulnerabilities Catalog.

In middle June, researchers from Sonarsource discovered the high-severity vulnerability impacting the Zimbra email suite, tracked as CVE-2022-27924 (CVSS score: 7.5). It can be exploited by an unauthenticated attacker to steal login credentials of users without user interaction.

“Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.” reads the advisory published by NIST.

Once obtained the login credentials, attackers can access the victims’ mailboxes and potentially escalate their access to targeted organizations.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

The researchers published a video PoC that demonstrates how an unauthenticated attacker can steal the password of a known user of a targeted instance.

The vulnerability is triggered the next time the victim uses a mail client to connect to the Zimbra server of a target organization.

Threat actors, which know the victims’ email addresses, can overwrite an entry in the cache to forward all IMAP traffic to an attacker-controlled server, including the cleartext credentials of a targeted user.

Zimbra addressed the issue on May 10, 2022, with the release of versions 8.8.15 P31.1 and 9.0.0 P24.1.

CISA orders federal agencies to fix the issue by August 25, 2022.

CISA hasn’t shared technical details of the attacks that exploit the Zimbra flaw.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Zimbra)

[adrotate banner=”5″]

[adrotate banner=”13″]