CVE-2023-34192

CVE-2023-34192 is a cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite version 8.8.15 that escalates to remote code execution. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H indicates network exploitability with low privileges and user interaction required, but with changed scope and maximum impact across all security objectives. The vulnerability resides in the /h/autoSaveDraft function, which handles the automatic saving of email drafts in the Zimbra web client. When a user composes an email, the client periodically sends draft content to the server through this endpoint. The server fails to properly sanitize HTML and JavaScript content within the draft data before storing and later rendering it. An authenticated attacker can craft a malicious email draft containing JavaScript payloads that execute when another user (such as an administrator) views or interacts with the content. The changed scope (S:C) reflects that the XSS executes in the victim's browser session, potentially a different security context than the attacker's authenticated session. The escalation to remote code execution occurs through the Zimbra administrative interface — if an administrator's session is compromised through the XSS, the attacker can leverage Zimbra's built-in server management capabilities to execute commands on the underlying operating system. Zimbra's architecture, which combines a Java application server, LDAP directory, and various mail services running as the zimbra user, provides a rich post-exploitation environment once server-side access is achieved.