Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability exists within the Webmail Classic UI of Zimbra Collaboration. This flaw allows for the inclusion of arbitrary files from the WebRoot directory. The potential impact includes unauthorized access to sensitive information and disruption of services.
- Webmail Classic UI
- Improper handling of user-supplied parameters
- Unauthorized file access and service disruption
Attack Path
How an attacker could exploit the issue
The Webmail Classic UI in Zimbra Collaboration is susceptible to a Local File Inclusion vulnerability due to improper handling of user-supplied request parameters. This allows an unauthenticated remote attacker to craft specific requests to the `/h/rest` endpoint. By influencing internal request dispatching, the attacker can gain the ability to include arbitrary files from the WebRoot directory. This attack path enables the attacker to potentially execute malicious code or access sensitive information within the affected system.
- Exposure: Public-facing Webmail interface.
- Attacker starting point: Remote, unauthenticated.
- Trigger and result: Craft requests to include arbitrary files.
Live Threat
Current exploitation, exposure, and threat context
A Local File Inclusion vulnerability in Zimbra Collaboration Suite's Webmail Classic UI could allow attackers to access arbitrary files within the WebRoot directory. This could lead to the exposure of sensitive information or further compromise of the system. The vulnerability is exploitable remotely by unauthenticated attackers.
- Likely attacker skill: Low
- Required access or conditions: Network access
- Business risk or urgency: High, treat as urgent
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
A vulnerability in Zimbra Collaboration's Webmail Classic UI allows remote attackers to include arbitrary files from the WebRoot directory. This occurs due to improper handling of user-supplied request parameters in the RestFilter servlet, enabling crafted requests to influence internal request dispatching. The potential impact includes unauthorized access to sensitive information and system compromise, posing a significant business risk.
- Locate all Zimbra Collaboration instances.
- Restrict access to affected endpoints.
- Implement vendor updates and verify.
- Monitor for suspicious activity.
