CVE-2019-9670

This Metasploit module exploits CVE-2019-9670 and CVE-2019-9621 in Zimbra Collaboration Suite, chaining XXE and SSRF vulnerabilities to achieve unauthenticated remote code execution via a JSP webshell upload.

This is a functional exploit for CVE-2019-9670, targeting Zimbra's Autodiscover Servlet XXE and ProxyServlet SSRF vulnerabilities. It extracts credentials via XXE, escalates privileges via SSRF to obtain an admin token, and uploads a payload for RCE.

This is a functional exploit for CVE-2019-9670, targeting Zimbra's Autodiscover Servlet XXE and ProxyServlet SSRF vulnerabilities. It extracts credentials via XXE, escalates privileges via SSRF to obtain an admin token, and uploads a payload for RCE.

This repository contains a Python-based scanner for detecting CVE-2019-9670, a vulnerability in Zimbra Collaboration Suite. The tool checks for the presence of the vulnerability by sending a crafted request and analyzing the response for specific indicators.

This is a Golang-based exploit for CVE-2019-9670, an XXE vulnerability in Zimbra Collaboration 8.7.X < 8.7.11p10. It sends a crafted XML payload to read the /etc/passwd file and checks for vulnerability.

This Metasploit module exploits CVE-2019-9670, an XXE vulnerability in Zimbra Collaboration Suite, to achieve unauthenticated remote code execution by chaining XXE, SSRF, and file upload techniques.