Threat update

There is a critical remote code execution (RCE) vulnerability in Zimbra Collaboration Suite (ZCS) version 9.0, tracked as CVE-2024-45519. The vulnerability allows unauthenticated attackers to remotely execute arbitrary commands by exploiting weaknesses in Zimbra's SMTP PostJournal service. 

Technical Detail and Additional Info

What is the threat?

This SMTP-based vulnerability allows unauthenticated remote attackers to send specially crafted requests to the Zimbra server, leading to command execution at the system level. Attackers can upload and execute malicious files without authentication, potentially resulting in data theft, server control, or further malware propagation. The exploitation could widely compromise critical systems.

Why is it noteworthy?

The exploitation of the PostJournal service allows for remote command execution without prior credentials, significantly lowering the barrier for attackers. This poses a substantial risk for sensitive data theft and system-wide control, making it urgent for organizations to implement mitigations.

What is the exposure or risk?

Organizations using ZCS 9.0 are at high risk, particularly if their Zimbra services are exposed to the Internet. Exploitation can lead to complete control of the system, allowing attackers to steal emails, access confidential data, or install persistent backdoors. Successful exploitation could also facilitate lateral movement within larger corporate or government email infrastructures. The minimal effort required for exploitation, due to the lack of authentication, means unpatched systems are especially vulnerable, presenting a significant risk to organizations that have not applied necessary security updates. The attack surface includes the mail server and potentially interconnected systems.

What are the recommendations?

 LBT Technology Group recommends the following actions to mitigate your risk:

• Apply the patches released by Zimbra immediately.
• Disable or limit external access to the SMTP service on Zimbra servers, ensuring it is only accessible via trusted networks or VPNs.
• Implement detailed monitoring on Zimbra servers to detect abnormal traffic patterns or unauthorized file uploads, particularly targeting the SMTP service.
• Take backups of email and critical data regularly to reduce the impact of a potential compromise.

References

 For more in-depth information about the recommendations, please visit the following links:

• https://pentest-tools.com/vulnerabilities-exploits/zimbra-collaboration-suite-900-remote-code-execution_23145
  
• https://blog.projectdiscovery.io/zimbra-remote-code-execution/

If you have any questions, please contact LBT's Sales Engineer.