CVE-2019-9621

This Metasploit module exploits CVE-2019-9670 and CVE-2019-9621 in Zimbra Collaboration Suite, chaining XXE and SSRF vulnerabilities to achieve unauthenticated remote code execution via a JSP webshell upload.

This exploit leverages an XXE vulnerability (CVE-2019-9621) in Zimbra Collaboration Suite to extract credentials, perform SSRF to obtain an admin token, and upload a malicious JSP shell for remote code execution. The PoC is functional and demonstrates a multi-stage attack chain.

This repository contains a working exploit for CVE-2019-9621, targeting Zimbra Collaboration Suite versions <8.8.11. The exploit chains XXE (XML External Entity) and SSRF (Server-Side Request Forgery) vulnerabilities to achieve unauthenticated remote code execution (RCE) by uploading a JSP webshell.

This Metasploit module exploits CVE-2019-9621, an XXE vulnerability in Zimbra Collaboration Suite's Autodiscover Servlet, combined with SSRF in the ProxyServlet to achieve unauthenticated remote code execution. It chains multiple steps: XXE to leak LDAP credentials, SSRF to escalate to admin, and file upload for JSP shell deployment.