CVE-2022-41352
About
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
Rainforest analyst review
The weakness sits in how Zimbra's amavis mail-scanning component unpacks archives. To inspect incoming attachments, amavis extracts them, and when it uses the cpio utility an attacker can craft an archive with a path-traversal loophole so that files land outside the scan directory, for example under the public Zimbra web root at /opt/zimbra/jetty/webapps/zimbra/public. By dropping a JSP web shell there and then requesting it, an unauthenticated attacker emailing the server gains code execution and can read other users' mail and accounts.
The underlying issue is really a missing dependency: Zimbra prefers the safer pax utility when present, but on RHEL/CentOS 7 and later pax is not installed by default, silently leaving cpio and the vulnerability in place. Zimbra is a full mail and collaboration platform, so a compromised server exposes an entire organization's correspondence and directory. Install the pax package so amavis stops using cpio, apply Zimbra's patches, and given the pre-patch exploitation of this bug, inspect the web root for planted shells and review mailbox access.
References
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html
- https://forums.zimbra.org/viewtopic.php?t=71153&p=306532
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41352
Related CVEs
Frequently asked questions
What is CVE-2022-41352?
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio.
How severe is CVE-2022-41352?
CVE-2022-41352 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2022-41352 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2022-41352?
Public advisories list the following as affected: zimbra collaboration suite. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-41352?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.