CVE-2022-41352
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Description
CVE-2022-41352 is a critical arbitrary file upload vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that allows an unauthenticated attacker to upload arbitrary files via the cpio package, ultimately gaining unauthorized access to any user account on the system. The vulnerability stems from improper handling of file uploads through the Amavis content filter, which uses cpio to extract archives without adequate path validation. With an EPSS score of 93.96% (99.88th percentile), this Zimbra vulnerability is nearly certain to be actively exploited. CISA added CVE-2022-41352 to the Known Exploited Vulnerabilities catalog on October 20, 2022, underscoring the urgency of remediation for all Zimbra deployments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | 9.0.0; 8.8.15 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- https://forums.zimbra.org/viewtopic.php?t=71153&p=306532(Mitigation, Vendor Advisory)
- https://wiki.zimbra.com/wiki/Security_Center(Patch, Release Notes, Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(Vendor Advisory)
- https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41352(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-41352 exploits a path traversal weakness in Zimbra Collaboration Suite's file handling mechanism. The cpio archive extraction process fails to properly validate pathnames, allowing attackers to write files to arbitrary locations on the server filesystem, escaping the intended upload directory. This enables webshell placement and account takeover.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2022-41352 is a critical severity vulnerability that is remotely exploitable without any authentication or user interaction, making it trivially accessible to any network-connected attacker. The vulnerability allows arbitrary file uploads to the Zimbra server, which can be leveraged to place webshells and gain full access to all user mailboxes and data. Confidentiality, integrity, and availability are all severely impacted: attackers can read all email communications, modify mailbox contents, and disrupt mail service operations entirely. With an EPSS score of 93.96%, exploitation activity is near-certain, and organizations running unpatched Zimbra instances face imminent risk of compromise.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-41352 in the wild by adding it to the Known Exploited Vulnerabilities catalog on October 20, 2022, with a remediation deadline of November 10, 2022. The EPSS score of 93.96% (99.88th percentile) indicates near-certain exploitation activity. Multiple public proof-of-concept exploits are available, and the vulnerability has been observed in targeted campaigns against government and enterprise Zimbra deployments. The ransomware association status is listed as unknown, but the ease of exploitation and broad attack surface make this a high-priority remediation target.
Remediation
- Apply Zimbra patches immediately: Update Zimbra Collaboration Suite to version 9.0.0 Patch 27 or 8.8.15 Patch 34 or later, which address the cpio file extraction vulnerability.
- Install pax as a workaround: If immediate patching is not possible, install the pax utility on the Zimbra server, as Zimbra's Amavis component will prefer pax over cpio, and pax is not affected by this path traversal issue.
- Scan for indicators of compromise: Check for suspicious webshells in the Zimbra web application directories, particularly in
/opt/zimbra/jetty/webapps/and related paths. Review server access logs for unusual file upload activity. - Restrict network access to Zimbra administrative interfaces: Limit access to the Zimbra admin console and mail ports to trusted IP ranges using firewall rules to reduce the attack surface.
- Monitor for anomalous email activity: Implement alerting on unusual mailbox access patterns, bulk email forwarding rules, or unexpected account delegation changes that could indicate post-exploitation activity.
Technical Details
CVE-2022-41352 targets the file upload handling mechanism in Zimbra Collaboration Suite, specifically the Amavis content filter that processes incoming email attachments. When Amavis receives an email with a specially crafted cpio archive attachment, it uses the cpio utility to extract the contents for virus scanning. The cpio extraction process does not properly sanitize file paths within the archive, allowing directory traversal sequences to place files in arbitrary locations on the Zimbra server's filesystem. An attacker can exploit this by sending an email with a malicious cpio archive that contains a JSP webshell targeting Zimbra's web application directory. Once the webshell is written to the webroot, the attacker can execute arbitrary commands with the privileges of the Zimbra service account, effectively compromising the entire mail system without any authentication.
Frequently Asked Questions
Is CVE-2022-41352 being actively exploited?
Yes, CVE-2022-41352 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on October 20, 2022, with a remediation deadline of November 10, 2022. The EPSS score of 93.96% further confirms widespread exploitation activity targeting Zimbra email servers.
What products are affected by CVE-2022-41352?
CVE-2022-41352 affects Synacor Zimbra Collaboration Suite (ZCS) versions prior to 9.0.0 Patch 27 and 8.8.15 Patch 34. The vulnerability specifically impacts installations where the cpio utility is used by Amavis for archive extraction, which is the default configuration on most Zimbra deployments.
How do I fix CVE-2022-41352?
Update Zimbra Collaboration Suite to the latest patched version. As an immediate workaround, install the pax package on the server, which Amavis will use instead of the vulnerable cpio utility. See the Remediation section for detailed steps.
How severe is CVE-2022-41352?
CVE-2022-41352 is a critical severity vulnerability with an EPSS score of 93.96% (99.88th percentile), indicating near-certain exploitation. It allows unauthenticated remote attackers to upload arbitrary files and gain complete control over the Zimbra mail server, making it one of the most dangerous Zimbra vulnerabilities disclosed in 2022.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.