{"uuid": "e9367e3f-293b-472c-99bf-40d6bc74aece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30333", "type": "seen", "source": "https://t.me/hacking_Attack/72486", "content": "Black Hat Ethical Hacking\nZimbra remote code execution vulnerability actively exploited in the wild\n\nZimbra remote code execution vulnerability actively exploited in the wildPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes A zero-day remote code execution (RCE) vulnerability in Zimbra is being actively exploited in the wild.\u200b\n\nThe bug was assigned the tracker CVE-2022-41352\u00a0in late September. Issued a CVSS severity score of 9.8, the critical issue can be exploited to plant a shell in the software\u2019s root directly, achieving RCE and enabling attackers to wreak havoc on a vulnerable system. Zimbra, once known as the Zimbra Collaboration Suite (ZCS), is an open source\u00a0email suite. The software is relied upon by millions of users and is designed for managing enterprise and SMB email and collaboration tools.\n\nAccording to Rapid7\u2019s AttackerKB project, CVE-2022-41352 is an RCE that \u201carises from unsafe usage of the cpio utility, specifically from Zimbra\u2019s antivirus engine\u2019s (Amavis) use of the vulnerable cpio utility to scan inbound emails\u201d.\n\nTo launch a successful attack, a threat actor would need to email a .cpio, .tar, or .rpm\u00a0file to a vulnerable server. Amavis would then scan the message for malware and use the cpio file utility to extract its content.\n\nHowever a \u2018loophole\u2019 exists where attackers could leverage cpio\u00a0to write to a target folder, or as Rapid7 says, \u201cwrite to any path on the filesystem that the Zimbra user can access\u201d.\n\nOnce inside, for example, an attacker may be able to extract emails, tamper with user accounts, wipe information, or conduct Business Email Compromise\u00a0(BEC) scams.\n\nOracle Linux 8, Red Hat Enterprise Linux 8, Rocky Linux 8, and CentOS 8 builds are vulnerable.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course \u2018Effectively identical\u2019Rapid7 researchers noted that CVE-2022-41352 is \u201ceffectively identical\u201d to CVE-2022-30333, a path traversal\u00a0bug in RarLab\u2019s unrar binary which also triggers an RCE in Zimbra. The only difference appears to be the file type (.cpio, instead of .rar).\n\nAccording to Rapid7 researcher Ron Bowes, the vulnerability is an exploit path for CVE-2015-1194, a bug that was patched in 2019. However, it appears that some distributions unintentionally remove the fix.\n\nA Zimbra forum post indicates that the vulnerability\u00a0is being actively exploited in the wild. Proof of concept (PoC) exploit code has been released.\n\nZimbra has acknowledged the vulnerability and says that a fix is being developed. In the meantime, Zimbra is urging users to install the pax package immediately and restart Zimbra as a workaround.\n\nPax is used for reading or writing archived file content and is not vulnerable to this exploit \u2013 but, unfortunately, Pax is not included by default. If Pax has not been installed, Amavis will resort to using cpio, and Zimbra says the \u201cpoor implementation\u201d of this process that created the vulnerability in the first place.\nTrending: A primer on OS Command Injection Attacks\nTrending: OSINT Tool: ProtOSINT Zimbra intends to remove the cpio dependency and make Pax a requirement.\n\nThere\u2019s better news for Ubuntu users \u2013 Pax is installed by default in Ubuntu 20.04, and in Ubuntu 18.04, a custom patch issued for cpio provides protection.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an arti[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:35.653470Z"}