Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925

Summary: Volexity investigated breaches of Zimbra Collaboration Suite email servers in July and early August 2022 and found the likely cause was CVE-2022-27925, an RCE patched in March 2022 in 8.8.15P31 and 9.0.0P24. Volexity determined the mboximport endpoint could be reached without authentication because the servlet's doPost function sets an error but has no return statement, turning the flaw into an unauthenticated RCE assigned CVE-2022-37042 and patched in 9.0.0P26 and 8.8.15P33.
Bottom line: Volexity's internet-wide scan found over 1,000 backdoored Zimbra instances, including government ministries, military branches, and businesses with billions in revenue, and it used only webshell paths it already knew, so the real count is likely higher.

Read the original at Volexity Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-27925 CVE-2022-37042
Related: Grey Noise | Zimbra Collaboration Suite vulnerability analysis Cyber Risks ·
CVE-2022-37042: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Aug 11, 2022
CVE-2022-27925: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability Known Exploited Vulnerabilities · Aug 11, 2022