CVE-2024-27443
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2024-27443 is a medium-severity cross-site scripting (XSS) vulnerability in the Synacor Zimbra Collaboration Suite (ZCS) affecting versions 9.0 and 10.0. The flaw resides in the CalendarInvite feature of the Zimbra webmail classic interface, where improper input validation of calendar headers allows an attacker to embed malicious JavaScript in a crafted email message. When a victim views the email in the Zimbra classic webmail client, the injected script executes in the context of the victim's browser session, potentially enabling session hijacking, credential theft, or unauthorized actions. CISA has added CVE-2024-27443 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 9, 2025, and its EPSS score of 30.11% at the 96th percentile signals a very high probability of exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zimbra | collaboration | >= 10.0.0, < 10.0.7; 9.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes(Release Notes)
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27443(US Government Resource)
- https://www.welivesecurity.com/en/eset-research/operation-roundpress/(Press/Media Coverage)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-27443 is classified under CWE-79, commonly known as Cross-site Scripting (XSS). In the Zimbra Collaboration Suite, the CalendarInvite feature fails to properly neutralize user-controllable input within calendar headers before rendering them in the classic webmail interface. This allows an attacker to inject malicious client-side scripts that execute when a victim views the crafted calendar invitation, potentially leading to session hijacking, credential theft, or phishing attacks within the trusted Zimbra domain.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Impact Analysis
CVE-2024-27443 carries a CVSS v3.1 base score of 6.1 (Medium) with an attack vector that is remotely exploitable over the network (AV:N) with low attack complexity (AC:L) and no authentication required (PR:N), though user interaction is required (UI:R) as the victim must view the malicious email. The scope is changed (S:C), meaning the vulnerability in the Zimbra webmail interface can affect resources beyond its own security context, such as the victim's browser session and potentially other web applications sharing the same origin. Confidentiality and integrity both face low impact, as an attacker can steal session cookies or inject content to perform actions on behalf of the victim, but the attack requires the victim to open the malicious message. With an EPSS score of 30.11%, this vulnerability sits in the 96th percentile, indicating exploitation is highly likely. The association of CVE-2024-27443 with Operation RoundPress, a targeted espionage campaign leveraging XSS in webmail platforms, underscores the real-world impact of this flaw.
Exploit Maturity
CVE-2024-27443 demonstrates significant exploit maturity. CISA has confirmed active exploitation in the wild by including it in the Known Exploited Vulnerabilities catalog. The EPSS score of 30.11% at the 96th percentile indicates that this vulnerability is among the most likely to be exploited across all tracked CVEs. Research from ESET documents its use in Operation RoundPress, a targeted espionage campaign that weaponized XSS vulnerabilities in webmail platforms including Zimbra to exfiltrate email data. While no standalone proof-of-concept exploit code has been tagged in the NVD references, the confirmed use in active campaigns and the trivial nature of reflected XSS exploitation make immediate remediation essential.
Remediation
- Apply vendor patches immediately. Upgrade Zimbra Collaboration Suite to version 10.0.7 or later for the 10.x branch, or apply patch P39 for the 9.0.0 branch. Detailed release notes are available at the Zimbra 10.0.7 release page and the Zimbra 9.0.0 P39 release page.
- Restrict classic webmail interface usage. If possible, migrate users to the modern Zimbra web client, which may not be affected by the same CalendarInvite rendering issue. Disable the classic UI for users who do not require it.
- Deploy Content Security Policy (CSP) headers. Configure strict CSP rules on the Zimbra web server to restrict inline script execution and limit allowed script sources, reducing the impact of any XSS payloads that bypass input validation.
- Monitor for indicators of compromise. Review email logs for messages with unusual calendar header content, especially those containing JavaScript or HTML event handlers. Check for evidence of session hijacking such as unexpected password resets, forwarding rule changes, or anomalous login locations.
- Implement email filtering rules. Configure mail transport agents or email security gateways to scan and quarantine messages with suspicious calendar header content before they reach user inboxes.
Technical Details
CVE-2024-27443 is a stored cross-site scripting vulnerability in the Zimbra Collaboration Suite's CalendarInvite processing within the classic webmail interface. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates that the attack is network-accessible, requires low complexity, needs no authentication, but depends on user interaction (viewing the email). The scope is changed, meaning the XSS payload executes in a security context beyond the vulnerable component itself, specifically the victim's browser session.
The vulnerability exists because the Zimbra classic UI does not properly sanitize or encode special HTML and JavaScript characters within calendar invitation headers before rendering them in the webmail display. An attacker crafts an email message containing a calendar invitation with a manipulated header field that includes JavaScript code. When the victim opens or previews this email in the classic interface, the browser interprets the unsanitized header content as executable HTML/JavaScript, running the attacker's payload with the victim's session privileges. This enables cookie theft via document.cookie access, DOM manipulation for phishing, and unauthorized API calls to the Zimbra server on behalf of the victim.
Frequently Asked Questions
Is CVE-2024-27443 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2024-27443 to the Known Exploited Vulnerabilities catalog. Additionally, ESET research has documented its use in Operation RoundPress, a targeted espionage campaign exploiting XSS vulnerabilities in webmail platforms.
What products are affected by CVE-2024-27443?
Zimbra Collaboration Suite (ZCS) versions 10.0.0 through 10.0.6 and version 9.0.0 (prior to patch P39) are affected. Organizations should upgrade to ZCS 10.0.7 or apply the P39 patch for the 9.0.0 branch.
How do I fix CVE-2024-27443?
Update Zimbra Collaboration Suite to version 10.0.7 or later for the 10.x branch, or apply patch P39 for the 9.0.0 branch. Additionally, consider deploying Content Security Policy headers, restricting classic UI access, and monitoring email logs for malicious calendar invitations.
How severe is CVE-2024-27443?
CVE-2024-27443 has a CVSS v3.1 base score of 6.1 (Medium). While the direct impact on confidentiality and integrity is rated low, the changed scope means the attacker can affect resources beyond the Zimbra application. The EPSS score of 30.11% at the 96th percentile indicates a very high probability of exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.