{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-41352/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-41352/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-41352/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-41352/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-41352/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-41352"},"sightings":{"href":"/api/v1/sightings/cve-2022-41352"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.95478,"kev":true,"percentile":0.99868},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-41352.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-41352\n\ninfo:\n  name: Zimbra Collaboration - Unrestricted File Upload\n  author: rxerium\n  severity: critical\n  description: |\n    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files through amavis via a cpio loophole that extracts to the webapps directory, potentially achieving remote code execution and unauthorized access to other user accounts in Zimbra Collaboration Suite.\n  remediation: |\n    Install pax package and ensure amavis is configured to use pax instead of cpio. Update to the latest patched version of Zimbra Collaboration Suite.\n  reference:\n    - https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-41352\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-41352\n    cwe-id: CWE-22\n    epss-score: 0.95478\n    epss-percentile: 0.99868\n    cpe: cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: zimbra\n    product: collaboration\n    shodan-query:\n      - http.favicon.hash:\"1624375939\"\n      - http.html:\"Zimbra Collaboration Suite Web Client\"\n    fofa-query: icon_hash=\"1624375939\"\n  tags: cve,cve2022,zimbra,kev,file-upload,passive,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Zimbra Collaboration Suite Web Client\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/x-javascript\"\n\n      - type: word\n        part: body\n        words:\n          - \"8.8.15\"\n          - \"9.0\"\n        condition: or\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - 'CLIENT_VERSION\",\\s*{type:ZmSetting\\.T_CONFIG,\\s*defaultValue:\"(.*?)\"'\n# digest: 4b0a004830460221008ec94a51f1bef4ebf395cbea6ba06afe208ebd1c76f361ebf5bd7d52e64e6b1e022100c3f8169caad4b27c43ae114d238ec87f7f68855cb794643153ae35d71b9548a1:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2022-41352"}