CVE-2019-9621
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2019-9621 is a high-severity server-side request forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS), one of the most widely deployed enterprise email and collaboration platforms. The vulnerability exists in the ProxyServlet component and allows an unauthenticated remote attacker to send crafted requests that cause the server to make arbitrary HTTP requests to internal services, potentially leading to sensitive information disclosure including internal credentials and configuration data. Rated CVSS v3.1 7.5, this SSRF flaw has been actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of July 28, 2025. With an EPSS score of 94.11% at the 99.9th percentile, CVE-2019-9621 remains one of the most exploited vulnerabilities in the email server landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | < 8.6.0; >= 8.7.0, < 8.7.11; >= 8.8.0, < 8.8.9; 8.6.0; 8.7.11; 8.8.9; 8.8.10; 8.8.11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce(Exploit, Third Party Advisory)
- https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html(Third Party Advisory)
- https://blog.zimbra.com/2019/03/9826/(Vendor Advisory)
- https://bugzilla.zimbra.com/show_bug.cgi?id=109127(Issue Tracking)
- https://wiki.zimbra.com/wiki/Security_Center(Release Notes, Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(Vendor Advisory)
- https://www.exploit-db.com/exploits/46693/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9621(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2019-9621 is classified under CWE-918, Server-Side Request Forgery. In the Zimbra Collaboration Suite, the ProxyServlet component fails to properly validate and restrict the destinations of server-side HTTP requests initiated by user-supplied input. This allows an attacker to redirect internal requests to arbitrary endpoints, including internal services and metadata APIs that should not be externally accessible.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
The impact of CVE-2019-9621 centers on confidentiality, with the ability to access sensitive internal resources through the Zimbra server acting as a proxy. The attack is network-accessible (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N), making it trivially exploitable against any internet-facing Zimbra deployment. Confidentiality impact is high (C:H) because the SSRF allows attackers to reach internal services, read server-side configuration files, access internal APIs, and potentially retrieve credentials stored in the Zimbra environment. When chained with other Zimbra vulnerabilities such as XXE flaws, this SSRF can escalate to full remote code execution, as demonstrated by publicly available exploit chains. The EPSS score of 94.11% at the 99.9th percentile confirms that this vulnerability is among the most actively exploited across all tracked CVEs, and organizations running unpatched Zimbra instances should consider them compromised.
Exploit Maturity
CVE-2019-9621 has reached maximum exploit maturity with multiple public exploits and exploit frameworks readily available. Exploit code is published on Packet Storm Security and Exploit-DB, and a Metasploit module is available via Rapid7 that chains this SSRF with XXE vulnerabilities for full remote code execution. CISA has confirmed active exploitation by adding CVE-2019-9621 to the KEV catalog. The EPSS score of 94.11% at the 99.9th percentile places it among the most exploited vulnerabilities globally. Despite being disclosed in 2019, this vulnerability continues to be actively targeted because many Zimbra deployments remain unpatched, making it a favorite target for both opportunistic attackers and state-sponsored threat groups.
Remediation
-
Upgrade Zimbra Collaboration Suite to a patched version immediately. Apply patches for ZCS 8.6 (patch 13+), 8.7.x (8.7.11 patch 10+), or 8.8.x (8.8.10 patch 7+ or 8.8.11 patch 3+). Consult the Zimbra Security Center for the latest patch information.
-
Restrict ProxyServlet access by implementing network-level controls that limit outbound HTTP requests from the Zimbra server. Configure firewall rules to prevent the Zimbra application from making requests to internal network ranges (RFC 1918) and cloud metadata endpoints (169.254.169.254).
-
Monitor for exploitation indicators by reviewing Zimbra access logs for unusual proxy requests, particularly those targeting internal IP addresses or localhost endpoints. Look for requests to the Autodiscover servlet and ProxyServlet paths with abnormal parameters that may indicate SSRF exploitation attempts.
-
Implement a web application firewall (WAF) in front of the Zimbra deployment to filter malicious requests targeting known SSRF patterns in the ProxyServlet and Autodiscover components.
-
Conduct a full security audit of the Zimbra environment, including checking for unauthorized accounts, modified configurations, webshells, and signs of data exfiltration. Given the age of this vulnerability and the availability of RCE exploit chains, assume compromise if the server was running an unpatched version while internet-facing.
Technical Details
CVE-2019-9621 is a server-side request forgery vulnerability in the ProxyServlet component of Zimbra Collaboration Suite, with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicating a network-accessible, low-complexity attack that requires no authentication or user interaction and impacts confidentiality. The ProxyServlet is designed to proxy HTTP requests on behalf of the Zimbra web client, but it fails to adequately validate the target URL supplied in user requests. An attacker can craft HTTP requests that cause the Zimbra server to initiate connections to arbitrary internal or external endpoints, effectively using the server as an open proxy. This is particularly dangerous because the Zimbra server typically has access to internal services, databases, and LDAP directories that are not directly accessible from the internet. The vulnerability is frequently chained with CVE-2019-9670, an XML External Entity (XXE) injection in the Autodiscover servlet, to achieve full remote code execution — a combination that has been weaponized in Metasploit and multiple standalone exploits. Affected versions include ZCS before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.11 patch 3.
Frequently Asked Questions
Is CVE-2019-9621 being actively exploited?
Yes. CVE-2019-9621 has been actively exploited since its disclosure in 2019 and continues to be targeted. CISA added it to the KEV catalog, and its EPSS score of 94.11% at the 99.9th percentile confirms it is among the most exploited vulnerabilities in existence.
What products are affected by CVE-2019-9621?
Synacor Zimbra Collaboration Suite versions before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.11 patch 3 are affected. This includes ZCS versions 8.6.0, 8.7.11, 8.8.9, 8.8.10, and 8.8.11 without the required patches.
How do I fix CVE-2019-9621?
Apply the appropriate Zimbra patch for your version immediately. Additionally, restrict outbound network access from the Zimbra server to prevent SSRF exploitation, and monitor logs for indicators of compromise.
How severe is CVE-2019-9621?
With a CVSS score of 7.5 (High) and an EPSS score of 94.11%, this is an extremely high-risk vulnerability. When chained with other Zimbra flaws like CVE-2019-9670, it enables full remote code execution, making unpatched Zimbra servers prime targets for attackers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.