{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-27925/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-27925/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-27925/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-27925/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-27925/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-27925/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2022-27925"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2022-27925"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-27925.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2022-27925\n\ninfo:\n  name: Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal\n  author: popy21\n  severity: high\n  description: |\n    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.\n  impact: |\n    An administrator-authenticated attacker uploads a ZIP whose entries traverse out of the extraction directory, dropping a JSP webshell into the Zimbra webroot for remote code execution as the zimbra user - and CVE-2022-37042 removes the authentication requirement entirely, which is how this pair was mass-exploited in the wild.\n  remediation: |\n    Apply Zimbra Collaboration 8.8.15 Patch 31 or 9.0.0 Patch 24 (both released 2022-03-30) or later, which also requires the CVE-2022-37042 fix in 8.8.15 Patch 33 / 9.0.0 Patch 26 to close the authentication bypass on the same mboximport endpoint.\n  reference:\n    - http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html\n    - https://wiki.zimbra.com/wiki/Security_Center\n    - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24\n    - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P31\n    - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories\n    - https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-27925\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.2\n    cve-id: CVE-2022-27925\n    cwe-id: CWE-22\n    epss-score: 0.98676\n    epss-percentile: 0.99924\n    cpe: cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: synacor\n    product: zimbra_collaboration_suite\n    shodan-query: http.title:\"Zimbra Collaboration Suite\"\n    fofa-query: title=\"Zimbra Collaboration Suite\"\n  tags: cve,cve2022,synacor,zimbra,zimbra-collaboration-suite,lfi,rce,kev,vkev,passive\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Zimbra Collaboration Suite Web Client\"\n\n      - type: word\n        part: header\n        words:\n          - \"application/x-javascript\"\n\n      - type: word\n        part: version\n        words:\n          - \"8.8.15\"\n          - \"9.0\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - 'CLIENT_VERSION\\\",\\s+{type:ZmSetting.T_CONFIG, defaultValue:\\\"(.*?)\"'\n# digest: 4a0a00473045022046a485b5822f0d8f4504b254645a7b3424da0101dd990681963718fdc1dd16f9022100cc25c2901e97dae907a46e16788440cd7dea319491ed799423963092cccf2e9d:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2022-27925"}