CVE-2019-9670
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Description
CVE-2019-9670 is a critical-severity XML External Entity (XXE) injection vulnerability in the mailboxd component of Synacor Zimbra Collaboration Suite (ZCS). The vulnerability exists in Zimbra Collaboration Suite version 8.7.x before 8.7.11p10 and can be triggered through the Autodiscover/Autodiscover.xml endpoint. An unauthenticated attacker with network access can exploit CVE-2019-9670 to read arbitrary files from the server, perform server-side request forgery (SSRF) to access internal services, and potentially achieve remote code execution. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.43% (99.985th percentile), the probability of active exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | >= 8.7.0, < 8.7.11; 8.7.11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce(Third Party Advisory)
- https://bugzilla.zimbra.com/show_bug.cgi?id=109129(Broken Link, Issue Tracking, Patch, Third Party Advisory)
- https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/(Exploit, Third Party Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(Vendor Advisory)
- https://www.exploit-db.com/exploits/46693/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9670(US Government Resource)
Weakness Type
CWE-611: Improper Restriction of XML External Entity Reference
CVE-2019-9670 stems from improper restriction of XML external entity references in the Zimbra Collaboration Suite mailboxd component. The XML parser processing Autodiscover requests does not properly disable external entity resolution, allowing attackers to craft XML documents containing malicious external entity references. When the Zimbra server processes these requests, it resolves the external entities, enabling file disclosure from the server filesystem, SSRF attacks against internal network resources, and in certain configurations, remote code execution.
Learn more: CWE-611 — Improper Restriction of XML External Entity Reference
Impact Analysis
CVE-2019-9670 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating maximum-severity risk. The vulnerability is remotely exploitable over the network with low attack complexity, no authentication required, and no user interaction needed. Confidentiality (High): Attackers can read sensitive files from the Zimbra server, including configuration files containing database credentials, LDAP passwords, and email content. Integrity (High): Through SSRF and potential remote code execution, attackers can modify server configurations, inject malicious content, and tamper with email data. Availability (High): Exploitation can lead to complete service disruption, either through direct denial of service via recursive XML entity expansion or through post-exploitation activities. The EPSS score of 94.43% confirms this is among the most actively targeted email server vulnerabilities, and organizations running unpatched Zimbra instances face an extremely high probability of compromise.
Exploit Maturity
CVE-2019-9670 has a very mature exploit landscape with multiple publicly available exploits. Public exploit code is available via Exploit Database and Packet Storm Security, providing proof-of-concept code for the XXE and SSRF attack chain. A Metasploit module is also available through Rapid7, further lowering the barrier to exploitation. CISA has confirmed active exploitation in the wild through the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-07-10. The EPSS score of 94.43% (99.985th percentile) indicates near-certain exploitation activity, and the SANS Internet Storm Center has published a detailed analysis documenting observed exploitation patterns.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade Zimbra Collaboration Suite 8.7.x to version 8.7.11 Patch 10 or later, as documented in the Zimbra Security Advisories.
- If running Zimbra Collaboration Suite 8.7.x prior to 8.7.11p10, prioritize the upgrade path to the latest supported release. Verify the installed patch level by checking the Zimbra admin console or running
zmcontrol -von the command line. - As an interim mitigation, restrict external network access to the Zimbra Autodiscover endpoint (
/Autodiscover/Autodiscover.xml) using reverse proxy rules or web application firewall (WAF) configurations. Disable DTD processing and external entity resolution in the Java XML parser configuration if possible. - Monitor Zimbra server logs for suspicious Autodiscover requests, particularly those containing XML external entity declarations or DOCTYPE definitions. Review access logs for unusual file read patterns and outbound SSRF connections from the mailboxd process.
- Implement network segmentation to limit the Zimbra server access to internal resources, reducing the impact of potential SSRF exploitation. Configure egress filtering to prevent the server from making unexpected outbound connections to attacker-controlled infrastructure.
Technical Details
CVE-2019-9670 is an XML External Entity injection vulnerability in the mailboxd component of Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10. The vulnerability is triggered through the Autodiscover service endpoint (Autodiscover/Autodiscover.xml), which processes XML input from client requests without properly disabling external entity resolution in the underlying XML parser. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires only network access with no authentication or user interaction, and achieves maximum impact across all three security dimensions. An attacker sends a specially crafted XML document containing DTD declarations with external entity references that cause the parser to read local files (such as /etc/passwd or Zimbra configuration files containing credentials) or make HTTP requests to internal services. The XXE vulnerability can be chained with the ProxyServlet SSRF capability to escalate from information disclosure to remote code execution, as the disclosed credentials can be used to authenticate to internal Zimbra administrative interfaces.
Frequently Asked Questions
Is CVE-2019-9670 being actively exploited?
Yes. CVE-2019-9670 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.43% (99.985th percentile) indicates near-certain exploitation activity. Multiple public exploits and a Metasploit module are available, making this vulnerability highly accessible to attackers.
What products are affected by CVE-2019-9670?
CVE-2019-9670 affects Synacor Zimbra Collaboration Suite version 8.7.x before 8.7.11 Patch 10. Specifically, the vulnerability is in the mailboxd component that handles the Autodiscover service. Organizations running any 8.7.x version of Zimbra Collaboration Suite without Patch 10 applied are vulnerable.
How do I fix CVE-2019-9670?
Upgrade Zimbra Collaboration Suite 8.7.x to version 8.7.11 Patch 10 or later. If immediate patching is not possible, restrict access to the Autodiscover endpoint and implement WAF rules to block XML requests containing external entity declarations. Monitor server logs for exploitation attempts targeting the Autodiscover service.
How severe is CVE-2019-9670?
CVE-2019-9670 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier. The EPSS score of 94.43% places it in the 99.985th percentile for exploitation likelihood. The vulnerability requires no authentication and can lead to complete server compromise through file disclosure, SSRF, and remote code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.