Email Vulnerabilities: Zimbra's Critical Flaws and How Attackers Use Webshells

Email Vulnerabilities and Their Exploitation

Attackers are actively exploiting a critical vulnerability in Zimbra’s email and collaboration server, with the goal of executing malicious commands

Understanding the Zimbra Vulnerability

Tracked as CVE-2024-45519, this weakness allows attackers to send specially crafted emails to an address hosted on the server, provided the admin has enabled the postjournal service. When successful, these attacks can lead to the installation of a webshell, effectively giving attackers a backdoor access.

• Critical Patch Available: Zimbra has recently issued a patch for this vulnerability, and it is crucial that all users implement it. Alternatively, ensuring that the postjournal service is disabled is vital.
• Mass Exploitation Detected: Security researcher Ivan Kwiatkowski reported instances of mass exploitation being exploited in the wild, with attacks originating from specific IP addresses.
• Action Required: Organizations using Zimbra need to take immediate steps to mitigate the risk associated with these vulnerabilities.

Immediate Action to Prevent Attacks

To protect your organization from these significant email vulnerabilities in Zimbra, prioritize applying the security patch. This will shield your systems from potential exploitation by malicious actors who leverage crafted emails to execute remote commands.