Grey Noise | Zimbra Collaboration Suite vulnerability analysis

Summary: NVD published CVE-2022-27925 on April 20th, 2022, a Zimbra Collaboration Suite 8.8.15 and 9.0 flaw letting an authenticated administrator upload arbitrary files and traverse directories. Volexity found an authentication bypass from an incomplete fix, published August 12th, 2022 as CVE-2022-37042, and GreyNoise observed both exploits in the wild as of August 18th, 2022, with POST attempts carrying zip archives that deploy JSP web shells.
What's compelling: Chaining the two CVEs lets an attacker skip authentication and drop a web shell for remote code execution, and GreyNoise has already seen two distinct JSP payloads in live traffic - one a generic command shell, one that logs a fixed string and deletes itself.

Read the original at GreyNoise Blog ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2022-27925 CVE-2022-37042
Related: Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925 Cyber Risks ·
CVE-2022-37042: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Aug 11, 2022
CVE-2022-27925: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability Known Exploited Vulnerabilities · Aug 11, 2022