Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite

guest · Aug 16, 2022

Alert (AA22-228A)
August 16, 2022

The Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) are publishing this joint Cybersecurity Advisory (CSA) in response to active exploitation of multiple Common Vulnerabilities and Exposures (CVEs) against Zimbra Collaboration Suite (ZCS), an enterprise cloud-hosted collaboration software and email platform. CVEs currently being exploited against ZCS include:

CVE-2022-24682

CVE-2022-27924

CVE-2022-27925 chained with CVE-2022-37042

CVE-2022-30333

Click to expand...

CVE-2022-27924
CVE-2022-27924 is a high-severity vulnerability enabling an unauthenticated malicious actor to inject arbitrary memcache commands into a targeted ZCS instance and cause an overwrite of arbitrary cached entries.
CVE-2022-27925 and CVE-2022-37042
On August 10, 2022, researchers from Volexity reported widespread exploitation—against over 1,000 ZCS instances—of CVE-2022-27925 in conjunction with CVE-2022-37042.[4]
Click to expand...

CVE-2022-30333
CVE-2022-30333 is a high-severity directory traversal vulnerability in RARLAB UnRAR on Linux and UNIX allowing a malicious actor to write to files during an extract (unpack) operation. A malicious actor can exploit CVE-2022-30333 against a ZCS server by sending an email with a malicious RAR file.
CVE-2022-24682
CVE-2022-24682 is a medium-severity vulnerability that impacts ZCS webmail clients running releases before 8.8.15 patch 30 (update 1), which contain a cross-site scripting (XSS) vulnerability allowing malicious actors to steal session cookie files.
Click to expand...

guest · Aug 22, 2022

CISA Updates Advisory on Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite
August 22, 2022

CISA and the Multi-State Information Sharing & Analysis Center (MS-ISAC) have updated joint Cybersecurity Advisory AA22-228A: Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite, originally released August 16, 2022. The advisory has been updated to include additional detection signatures.

CISA encourages organizations to review the latest update to AA22-228A and apply the recommended mitigations.
Click to expand...

imdb · Oct 8, 2022

An unpatched code-execution vulnerability in the Zimbra Collaboration software is under active exploitation by attackers using the attacks to backdoor servers.

The attacks began no later than September 7, when a Zimbra customer reported a few days later that a server running the company's Amavis spam-filtering engine processed an email containing a malicious attachment. Within seconds, the scanner copied a malicious Java file to the server and then executed it. With that, the attackers had installed a web shell, which they could then use to log into and take control of the server.

Zimbra has yet to release a patch fixing the vulnerability. Instead, the company published this guidance that advises customers to ensure a file archiver known as pax is installed. Unless pax is installed, Amavis processes incoming attachments with cpio, an alternate archiver that has known vulnerabilities that were never fixed.
Click to expand...

Unpatched Zimbra flaw under attack is letting hackers backdoor servers by Dan Goodin

guest · Nov 10, 2022

CISA Updates Advisory on Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite
Original release date: November 10, 2022

CISA and the Multi-State Information Sharing & Analysis Center (MS-ISAC) have updated joint Cybersecurity Advisory AA22-228A: Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite, originally released August 16, 2022. The advisory has been updated to include an additional Malware Analysis Report containing new indicators of compromise.

CISA encourages organizations to review the latest update to AA22-228A and apply the recommended mitigations.
Click to expand...

guest · Feb 2, 2023

North Korean Hackers Exploit Unpatched Zimbra Devices in 'No Pineapple' Campaign
By Ravie Lakshmanan - February 2, 2023

A new intelligence gathering campaign linked to the prolific North Korean state-sponsored Lazarus Group leveraged known security flaws in unpatched Zimbra devices to compromise victim systems.
Click to expand...

That's according to Finnish cybersecurity company WithSecure (formerly F-Secure), which codenamed the incident No Pineapple.

Targets of the malicious operation included a healthcare research organization in India, the chemical engineering department of a leading research university, as well as a manufacturer of technology used in the energy, research, defense, and healthcare sectors, suggesting an attempt to breach the supply chain.
Click to expand...

Roughly 100GB of data is estimated to have been exported by the hacking crew following the compromise of an unnamed customer, with the digital break-in likely taking place in the third quarter of 2022.

"The threat actor gained access to the network by exploiting a vulnerable Zimbra mail server at the end of August," WithSecure said in a detailed technical report shared with The Hacker News.
The security flaws used for initial access are CVE-2022-27925 and CVE-2022-37042, both of which could be abused to gain remote code execution on the underlying server.
Click to expand...

Log in or Sign up

Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite

guest Guest

guest Guest

imdb Registered Member

guest Guest

guest Guest

Log in or Sign up

Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite

guest Guest

guest Guest

imdb Registered Member

guest Guest

guest Guest

Useful Searches