Exploitation Summary
EIP tracks 1 public exploit for CVE-2015-1197.
PoCs published by Alexander Cherepanov, yeak, Ron Bowes, including Metasploit module exploits/linux/http/zimbra_cpio_cve_2022_41352.
AI-analyzed exploit summary This Metasploit module exploits CVE-2022-41352 in Zimbra Collaboration Suite by leveraging a path traversal vulnerability in the cpio utility (CVE-2015-1197). It crafts a malicious .tar file containing a symlink and a JSP payload, which, when processed by the Zimbra server, deploys a backdoor in the public web directory.
Description
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
Exploits (1)
This Metasploit module exploits CVE-2022-41352 in Zimbra Collaboration Suite by leveraging a path traversal vulnerability in the cpio utility (CVE-2015-1197). It crafts a malicious .tar file containing a symlink and a JSP payload, which, when processed by the Zimbra server, deploys a backdoor in the public web directory.