Executive brief
Zimbra Collaboration, a widely used enterprise email and collaboration platform, was found to have security flaws that could allow an attacker to hijack a user's session. By tricking an authenticated user (such as an administrator) into clicking a malicious link, an attacker could perform unauthorized actions, such as uploading malicious files or modifying server settings. This could lead to a full compromise of the email server and unauthorized access to sensitive corporate communications.
Technical details
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in Zimbra Collaboration Suite (ZCS) due to a lack of CSRF token validation in specific components. The first issue resides in the Client uploader extension, which uses a custom upload handler separate from the standard FileUploadServlet that failed to check for tokens. The second issue involves extension REST handlers where the CsrfFilter was not being invoked for requests directed at the /service/extension/ path. A remote attacker can exploit these by inducing an authenticated user to visit a malicious webpage, allowing the attacker to execute arbitrary REST commands or upload files (such as ZCO files) with the victim's privileges. These issues were addressed in version 8.7.0 by generalizing CSRF token checks and updating the filter configuration.
Affected products
- Zimbra Zimbra Collaboration before 8.7.0
Timeline
- 2016-03-08: other: Initial internal report of Client uploader CSRF
- 2016-03-23: other: Initial internal report of REST handler CSRF
- 2016-06-22: patched: Fixes verified in development branch
- 2017-01-18: disclosed: NVD publication date