CVE-2022-27925
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Description
CVE-2022-27925 is an arbitrary file upload vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that allows an authenticated attacker to upload arbitrary files through the mboximport functionality, leading to remote code execution on the server. When chained with CVE-2022-37042, an authentication bypass vulnerability, this flaw enables unauthenticated remote code execution. CISA has added CVE-2022-27925 to its Known Exploited Vulnerabilities catalog, confirming active exploitation, and the vulnerability is known to be used in ransomware campaigns. With an EPSS score of 94.3% (99.9th percentile), this is one of the most actively exploited vulnerabilities tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | 8.8.15; 9.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- https://wiki.zimbra.com/wiki/Security_Center(Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24(Release Notes, Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27925(US Government Resource)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
CVE-2022-27925 exploits an unrestricted file upload vulnerability in the Zimbra Collaboration Suite's mboximport functionality. The file upload mechanism fails to properly validate or restrict the types of files that can be uploaded, allowing an attacker to upload executable files such as web shells that are subsequently executed on the server. In the context of ZCS, this enables the attacker to place malicious code on the mail server that provides persistent remote access.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2022-27925 poses a critical risk to organizations using Zimbra Collaboration Suite, as the arbitrary file upload can lead to complete server compromise through web shell deployment. While the vulnerability itself requires authentication, its combination with CVE-2022-37042 removes this barrier, enabling fully unauthenticated attacks. Successful exploitation grants the attacker the ability to execute arbitrary code on the mail server, providing access to all email communications, stored attachments, address books, and calendar data. The confidentiality impact is severe as all email data can be exfiltrated; integrity is compromised as the attacker can modify mail routing and inject content; and availability can be disrupted through service manipulation or ransomware deployment. The confirmed use in ransomware campaigns and the EPSS score of 94.3% (99.9th percentile) underscore the extreme real-world risk.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-27925 in the wild by adding it to the Known Exploited Vulnerabilities catalog on August 11, 2022, with a remediation deadline of September 1, 2022. This vulnerability is known to be used in ransomware campaigns, significantly increasing the threat to organizations. The EPSS score of 94.3% (99.9th percentile) places this among the most actively exploited vulnerabilities globally. When combined with CVE-2022-37042, the authentication bypass vulnerability, the attack becomes unauthenticated, dramatically lowering the barrier to exploitation and enabling mass scanning and automated exploitation campaigns against internet-facing Zimbra instances.
Remediation
- Apply Zimbra security updates immediately: Install the patches referenced in the Zimbra security advisory for CVE-2022-27925, which addresses the arbitrary file upload in the mboximport functionality.
- Also patch CVE-2022-37042: Since these vulnerabilities are commonly chained together, ensure both CVE-2022-27925 and the authentication bypass CVE-2022-37042 are patched simultaneously.
- Scan for web shells and indicators of compromise: Conduct a thorough review of the Zimbra installation for uploaded web shells, unauthorized files in web-accessible directories, and suspicious scheduled tasks that may indicate prior exploitation.
- Restrict access to the Zimbra management interface: Implement network-level access controls to limit who can reach the Zimbra administration and mboximport endpoints, reducing the attack surface for both authenticated and unauthenticated attacks.
- Implement email security monitoring: Deploy monitoring for anomalous mail server behavior including unusual outbound data transfers, unexpected administrative actions, and signs of ransomware activity such as mass file encryption.
Technical Details
CVE-2022-27925 is an arbitrary file upload vulnerability in the mboximport functionality of Synacor Zimbra Collaboration Suite. The mboximport feature is designed to allow administrators to import mailbox data, but the implementation contains a flaw where the uploaded file's type and content are not properly validated. An authenticated attacker can exploit this to upload arbitrary files, including JSP web shells, to the server's web-accessible directories. Once uploaded, these files can be accessed through the web server to execute arbitrary commands on the underlying operating system. The critical escalation path occurs when this vulnerability is chained with CVE-2022-37042, an authentication bypass in the MailboxImportServlet, which removes the authentication requirement entirely. Together, these two vulnerabilities create a complete unauthenticated remote code execution chain that has been widely exploited against internet-facing Zimbra deployments, including in ransomware operations.
Frequently Asked Questions
Is CVE-2022-27925 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-27925 and has added it to the Known Exploited Vulnerabilities catalog. The vulnerability is known to be used in ransomware campaigns. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation, particularly when chained with CVE-2022-37042 for unauthenticated access.
What products are affected by CVE-2022-27925?
CVE-2022-27925 affects Synacor Zimbra Collaboration Suite (ZCS). The vulnerability is in the mboximport functionality. Organizations running Zimbra for email services should consult the Zimbra security advisory for specific affected versions and apply patches immediately.
How do I fix CVE-2022-27925?
Apply the security updates from Zimbra that address both CVE-2022-27925 and CVE-2022-37042, as these vulnerabilities are commonly exploited together. After patching, scan the Zimbra installation for web shells or other indicators of prior compromise. Restrict access to administrative interfaces as an additional defense measure.
How severe is CVE-2022-27925?
CVE-2022-27925 is an extremely severe vulnerability with an EPSS score of 94.3% (99.9th percentile) and confirmed use in ransomware campaigns. When chained with CVE-2022-37042, it enables fully unauthenticated remote code execution on Zimbra mail servers, potentially compromising all email data and providing a platform for further network intrusion.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.