#Zimbra desktop exploit install#
#Zimbra desktop exploit full#

#Zimbra desktop exploit install#

In the event of either of these situations, the attackers would be allowed to install malicious JavaScript code via the Zimbra web client based on Ajax, static HTML and mobile optimization, and then be able to execute the removal of the HTML content in the mail received by the server. According to the researchers, this vulnerability can be used to exploit the server using any authenticated user, regardless of their privileges.

#Zimbra desktop exploit full#

Upon execution of the payload, an attacker will have complete access to all of the victim’s email inbox and outbox (with the exception of their webmail session information), along with full access to other functions of the Zimbra suite, enabling a variety of additional attacks.Ī server-side request forgery vulnerability (CVE-2021-35209) leads to a possible and powerful server-side request forgery by bypassing the allowed list of access control. The email containing the malware will have a sophisticated JavaScript Payload.

CVE-2021-35209 (CVSS score: 6.1)- Server-Side Request Forgery (SSRF)Ī cross-site scripting vulnerability (CVE-2021-35208) will be triggered when a user accesses emails from Zimbra.

CVE-2021-35208 (CVSS score: 5.4)- DOM-based Stored Cross-Site-Scripting (XSS).As a result, an attacker would gain unrestricted access to all sent and received emails of all employees. A combination of these vulnerabilities could enable an unauthenticated attacker to compromise a targeted organization’s Zimbra webmail server. Two open-source code vulnerabilities recently discovered by security experts at SonarSource may allow attackers to compromise company webmail servers that are using Zimbra. More than 200,000 companies and over 1,000 governments and financial institutions use Zimbra’s messaging service, which works by connecting the information and activities of end users to the private cloud, and every day, millions of people use it to exchange emails. Zimbra, an open-source collaborative office suite, consisting of webmail, web document creation and management, calendar, and address book built for the cloud.