CVE-2022-37042
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
Description
CVE-2022-37042 is an authentication bypass vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that exists in the MailboxImportServlet component. This flaw allows an unauthenticated attacker to bypass authentication controls and access restricted functionality. When chained with CVE-2022-27925, an arbitrary file upload vulnerability, it enables fully unauthenticated remote code execution on Zimbra mail servers. CISA has added CVE-2022-37042 to its Known Exploited Vulnerabilities catalog, confirming active exploitation, and the vulnerability is known to be used in ransomware campaigns. With an EPSS score of 94.3% (99.9th percentile), this vulnerability is among the most actively targeted flaws globally.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | 8.8.15; 9.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- https://wiki.zimbra.com/wiki/Security_Center(Patch, Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37042(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2022-37042 exploits improper authentication in the Zimbra Collaboration Suite's MailboxImportServlet, where the servlet fails to properly verify that the requesting user has been authenticated before granting access to import functionality. This authentication bypass allows unauthenticated attackers to reach endpoints that should require valid credentials, providing the critical first step in an exploit chain that leads to remote code execution.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2022-37042 is a critical authentication bypass that transforms authenticated-only vulnerabilities in Zimbra into unauthenticated attack vectors. The vulnerability requires no authentication and can be exploited remotely over the network without any user interaction, making it trivially exploitable by automated scanning tools. When combined with CVE-2022-27925, the authentication bypass enables complete remote code execution on the Zimbra mail server without any credentials. Confidentiality of all email data is at immediate risk, integrity of the mail system can be completely compromised, and availability can be disrupted through ransomware deployment or service destruction. The confirmed use in ransomware campaigns and the EPSS score of 94.3% (99.9th percentile) confirm that this vulnerability is actively being mass-exploited against internet-facing Zimbra deployments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-37042 in the wild by adding it to the Known Exploited Vulnerabilities catalog on August 11, 2022, with a remediation deadline of September 1, 2022. This vulnerability is known to be used in ransomware campaigns, representing one of the highest threat levels. The EPSS score of 94.3% (99.9th percentile) places this among the most actively exploited vulnerabilities globally. When combined with CVE-2022-27925, the authentication bypass creates a fully unauthenticated remote code execution chain that has been widely adopted by both ransomware groups and APT actors for compromising Zimbra mail infrastructure at scale.
Remediation
- Apply Zimbra security updates immediately: Install the patches that address CVE-2022-37042 and the related authentication bypass in the MailboxImportServlet, as referenced in the Zimbra security advisory.
- Simultaneously patch CVE-2022-27925: These vulnerabilities are exploited as a chain; ensure both the authentication bypass (CVE-2022-37042) and the file upload vulnerability (CVE-2022-27925) are addressed in the same maintenance window.
- Conduct forensic analysis for prior compromise: Given the high exploitation rate, assume compromise if the Zimbra instance was internet-facing and unpatched. Search for web shells, unauthorized admin accounts, mail forwarding rules, and indicators of data exfiltration.
- Implement network-level access restrictions: Place the Zimbra MailboxImportServlet endpoint behind a VPN or restrict access to known administrative IP addresses to prevent unauthenticated access even if future bypass vulnerabilities emerge.
- Deploy web application firewall rules: Configure WAF rules to detect and block exploitation attempts targeting the MailboxImportServlet endpoint, including suspicious import requests from unauthenticated sessions.
Technical Details
CVE-2022-37042 is an authentication bypass vulnerability in the MailboxImportServlet of Synacor Zimbra Collaboration Suite. The MailboxImportServlet is intended to allow authenticated administrators to import mailbox data into the system. However, a flaw in the authentication logic allows unauthenticated requests to reach the servlet's functionality without providing valid credentials. This authentication bypass provides the critical first stage of an exploit chain: once an attacker can access the import functionality without credentials, they can leverage CVE-2022-27925's arbitrary file upload to deploy web shells or other malicious payloads on the Zimbra server. The combined attack chain has been widely adopted for mass exploitation because it requires no prior knowledge of user credentials and can be fully automated — a single HTTP request chain can compromise a Zimbra server from unauthenticated access to remote code execution. The vulnerability is particularly impactful because Zimbra servers typically process sensitive email data and are often internet-facing to serve webmail functionality.
Frequently Asked Questions
Is CVE-2022-37042 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-37042 and has added it to the Known Exploited Vulnerabilities catalog. The vulnerability is known to be used in ransomware campaigns. When chained with CVE-2022-27925, it provides fully unauthenticated remote code execution, and the EPSS score of 94.3% (99.9th percentile) confirms near-certain exploitation.
What products are affected by CVE-2022-37042?
CVE-2022-37042 affects Synacor Zimbra Collaboration Suite (ZCS) through the MailboxImportServlet component. Organizations running Zimbra should consult the Zimbra security advisory for specific affected versions and apply patches immediately.
How do I fix CVE-2022-37042?
Apply the Zimbra security updates that address both CVE-2022-37042 and CVE-2022-27925, as these vulnerabilities are exploited as a chain. After patching, perform a thorough compromise assessment including scanning for web shells, unauthorized accounts, and suspicious mail forwarding rules.
How severe is CVE-2022-37042?
CVE-2022-37042 is an extremely severe authentication bypass vulnerability with an EPSS score of 94.3% (99.9th percentile) and confirmed use in ransomware campaigns. As the enabling component for unauthenticated remote code execution when chained with CVE-2022-27925, it represents one of the highest-risk vulnerabilities for organizations running Zimbra email infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.