Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal. References: http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24 https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P31 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/ https://nvd.nist.gov/vuln/detail/CVE-2022-27925 Remediation: Apply Zimbra Collaboration 8.8.15 Patch 31 or 9.0.0 Patch 24 (both released 2022-03-30) or later, which also requires the CVE-2022-37042 fix in 8.8.15 Patch 33 / 9.0.0 Patch 26 to close the authentication bypass on the same mboximport endpoint.
url