Is CVE-2016-3406 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-3406 being exploited in the wild.

How severe is CVE-2016-3406?

High severity, with a CVSS score of 8.8, published 18 January 2017.

Which products and versions are affected?

Zimbra Collaboration before 8.7.0.

Is there a fix for CVE-2016-3406?

A patch was published on 2016-06-22: Fixes verified in development branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-3406 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-3406?

Check whether you run Synacor Zimbra Collaboration Suite or Zimbra Collaboration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-3406: Zimbra Collaboration CSRF in Client uploader and REST handlers

CVE-2016-3406 · Severity: high · CVSS 8.8 · Published 2017-01-18

Zimbra Collaboration, a widely used enterprise email and collaboration platform, was found to have security flaws that could allow an attacker to hijack a user's session. By tricking an authenticated user (such as an administrator) into clicking a malicious link, an attacker could perform unauthorized actions, such as uploading malicious files or modifying server settings. This could lead to a full compromise of the email server and unauthorized access to sensitive corporate communications.

Technologies: Synacor Zimbra Collaboration Suite, Zimbra Collaboration. Vendors: Synacor, Zimbra.

Quick answers

Is CVE-2016-3406 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-3406 being exploited in the wild.
How severe is CVE-2016-3406?: High severity, with a CVSS score of 8.8, published 18 January 2017.
Which products and versions are affected?: Zimbra Collaboration before 8.7.0.
Is there a fix for CVE-2016-3406?: A patch was published on 2016-06-22: Fixes verified in development branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-3406 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-3406?: Check whether you run Synacor Zimbra Collaboration Suite or Zimbra Collaboration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in Zimbra Collaboration Suite (ZCS) due to a lack of CSRF token validation in specific components. The first issue resides in the Client uploader extension, which uses a custom upload handler separate from the standard FileUploadServlet that failed to check for tokens. The second issue involves extension REST handlers where the CsrfFilter was not being invoked for requests directed at the /service/extension/ path. A remote attacker can exploit these by inducing an authenticated user to visit a malicious webpage, allowing the attacker to execute arbitrary REST commands or upload files (such as ZCO files) with the victim's privileges. These issues were addressed in version 8.7.0 by generalizing CSRF token checks and updating the filter configuration.

Affected products

Zimbra Zimbra Collaboration before 8.7.0

Timeline

2016-03-08: other: Initial internal report of Client uploader CSRF
2016-03-23: other: Initial internal report of REST handler CSRF
2016-06-22: patched: Fixes verified in development branch
2017-01-18: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.