CVE-2022-41352
CRITICAL KEV RANSOMWARE NUCLEIZimbra Collaboration <9.0 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2022-41352 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added October 20, 2022, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including Cr4ckC4t, segfault-it, qailanet. A Nuclei detection template is also available.
AI-analyzed exploit summary This is a working exploit for CVE-2022-41352, an arbitrary file write vulnerability in Zimbra mail servers due to a vulnerable `cpio` version. The exploit crafts a malicious tar file to achieve unauthenticated remote code execution by writing a JSP webshell to the target server.
Description
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
Exploits (3)
This is a working exploit for CVE-2022-41352, an arbitrary file write vulnerability in Zimbra mail servers due to a vulnerable `cpio` version. The exploit crafts a malicious tar file to achieve unauthenticated remote code execution by writing a JSP webshell to the target server.
This PoC exploits CVE-2022-41352, a path traversal vulnerability in cpio, by crafting a malicious tar archive with a symlink that extracts files outside the intended directory. The script generates a tar file with a symlink pointing to a parent directory, demonstrating arbitrary file write capabilities.
Nuclei Templates (1)
http.favicon.hash:"1624375939" || http.html:"Zimbra Collaboration Suite Web Client"
icon_hash="1624375939"
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H