CVE-2022-24682
published 2022-02-09CVE-2022-24682: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in…
PriorityP184medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-03-11
Exploited in the wild
EPSS
31.06%
98.0th percentile
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| synacor | zimbra_collaboration_suite | — | — |
| synacor | zimbra_collaboration_suite | >= 8.8.0 < 8.8.15 | 8.8.15 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for outbound HTTP POST requests from Zimbra webmail sessions to external domains, which may indicate the JavaScript mail-theft payload exfiltrating email body and attachment data. ↗
- →The attacker's JavaScript payload must first request a page containing a CSRF-Token before making subsequent mail-theft requests; monitor for anomalous CSRF-token fetches followed by bulk mail retrieval in Zimbra logs. ↗
- →Reconnaissance phase used unique per-target image-beacon URLs (Freenom .ga domains on AS399269/BitLaunch) embedded in spear-phishing emails; monitor for outbound GET requests to .ga/.tk/.ml Freenom domains from mail clients. ↗
- →All attacker-controlled servers were observed running Apache 2.4.6 on CentOS with PHP 5.4.16 with ZeroSSL certificates; this server fingerprint can be used to pivot on related infrastructure. ↗
- →Attacker used 74 unique outlook.com sender addresses formatted as <name>_<name>@outlook.com or <name>.<name>@outlook.com with feminine first names; flag bulk outlook.com senders with this naming pattern targeting Zimbra users. ↗
- ·CVE-2022-24682 affects only Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 update 2; version 9.0.0 was tested and found likely unaffected. ↗
- ·The specific vulnerable URI pattern required for exploitation was intentionally withheld by Volexity at time of initial disclosure due to the absence of a patch. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck6.1MEDIUM
cisa6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
cisa·2022-02-25·CVSS 6.1
CVE-2022-24682 [MEDIUM] CWE-79 Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Vulnerability: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Affected: Synacor Zimbra Collaborate Suite (ZCS)
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-24682
Remediation Due Date: 2022-03-11
GHSA
GHSA-fh88-2p7h-7g9h: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8
ghsa_unreviewed·2022-02-10
CVE-2022-24682 [MEDIUM] CWE-116 GHSA-fh88-2p7h-7g9h: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
VulnCheck
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
vulncheck·2022·CVSS 6.1
CVE-2022-24682 [MEDIUM] CWE-79 Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.
Affected: Synacor Zimbra Collaboration Suite (ZCS)
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/; https://www.cve.org/CVERecord?id=CVE-2022-24682; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://assets.sentinelone.com/wt-reports/watchtowe
No detection rules found.
Nuclei
Zimbra Collaboration Suite < 8.8.15 - Improper Encoding
nuclei·CVSS 6.1
CVE-2022-24682 [MEDIUM] Zimbra Collaboration Suite < 8.8.15 - Improper Encoding
Zimbra Collaboration Suite 8.7.15')"
condition: and
extractors:
- type: regex
part: body
name: detected_version
group: 1
regex:
- CLIENT_VERSION\",\s+{type:ZmSetting\.T_CONFIG, defaultValue:"([0-9.]+)_([A-Z_0-9]+)"\}
# digest: 490a0046304402204d5904d212c4f527f75e6f202a9e9fc401e1696425ba3d0722e8e2f2a64ad86602207f04e26c5dcea78fa89d1fbd2c461dd27fd37d84b73acf7a34f57a86e7fa24a5:922c64590222798bb761d5b6d8e72950
Bleepingcomputer
Google: Hackers exploited Zimbra zero-day in attacks on govt orgs
blogs_bleepingcomputer·2023-11-17·CVSS 6.1
CVE-2023-37580 [MEDIUM] Google: Hackers exploited Zimbra zero-day in attacks on govt orgs
## Google: Hackers exploited Zimbra zero-day in attacks on govt orgs
## Bill Toulas
Google's Threat Analysis Group (TAG) has discovered that threat actors exploited a zero-day vulnerability in Zimbra Collaboration email server to steal sensitive data from government systems in multiple countries.
Hackers leveraged a medium-severity security issue now identified as CVE-2023-37580 since June 29, nearly a month before the vendor addressed it in version 8.8.15 Patch 41of the software on July 25.
The flaw is an XSS (cross-site scripting) issue present in the Zimbra Classic Web Client.
## Attack and response timeline
According to Google's threat analysts, the threat actors exploited the vulnerability on government systems in Greece, Moldova, Tunisia, Vietnam, and Pakistan to steal email da
Google Tag
Zimbra 0-day used to target international government organizations
blogs_google_tag·2023-11-16·CVSS 6.1
CVE-2023-37580 [MEDIUM] Zimbra 0-day used to target international government organizations
Threat Analysis Group
## Zimbra 0-day used to target international government organizations
Nov 16, 2023
In June 2023, Google’s Threat Analysis Group (TAG) discovered an in-the-wild 0-day exploit targeting Zimbra Collaboration, an email server many organizations use to host their email. Since discovering the 0-day, now patched as CVE-2023-37580 , TAG has observed four different groups exploiting the same bug to steal email data, user credentials, and authentication tokens. Most of this activity occurred after the initial fix became public on Github. To ensure protection against these types of exploits, TAG urges users and organizations to keep software fully up-to-date and apply security updates as soon as they become available.
## 0-day discovery, hotfix and patch
TAG first discovere
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Volexity
Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
blogs_volexity·2022-02-03·CVSS 6.1
CVE-2022-24682 [MEDIUM] Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
Threat Intelligence
# Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
February 3, 2022
Steven Adair and Tom Lancaster
[UPDATE] On February 4, 2022, Zimbra provided an update regarding this zero-day exploit vulnerability and reported that a hotfix for 8.8.15 P30 would be available on February 5, 2022. This vulnerability was later assigned CVE-2022-24682 and was fixed in version 8.8.15P30 Update 2 of Zimbra Collaboration Suite.
In December 2021, through its Network Security Monitoring service, Volexity identified a series of targeted spear-phishing campaigns against one of its customers from a threat actor it tracks as TEMP_Heretic. Analysis of the emails from these spear phishing campaigns led to a discovery: the attacker was attempting to exploit a ze
Volexity
Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
blogs_volexity·2022-02-03·CVSS 6.1
CVE-2022-24682 [MEDIUM] Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
Threat Intelligence
## Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
February 3, 2022
Steven Adair and Tom Lancaster
[UPDATE] On February 4, 2022, Zimbra provided an update regarding this zero-day exploit vulnerability and reported that a hotfix for 8.8.15 P30 would be available on February 5, 2022. This vulnerability was later assigned CVE-2022-24682 and was fixed in version 8.8.15P30 Update 2 of Zimbra Collaboration Suite.
In December 2021, through its Network Security Monitoring service, Volexity identified a series of targeted spear-phishing campaigns against one of its customers from a threat actor it tracks as TEMP_Heretic . Analysis of the emails from these spear phishing campaigns led to a discovery: the attacker was attempting to exploit a
Recorded Future
RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale
blogs_recorded_future
RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale
# RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale
New Insikt Group research examines RedHotel, a Chinese state-sponsored threat activity group that stands out due to its persistence, operational intensity, and global reach. RedHotel's operations span 17 countries in Asia, Europe, and North America from 2021 to 2023. Its targets encompass academia, aerospace, government, media, telecommunications, and research sectors. Particularly focused on Southeast Asia's governments and private companies in specified sectors, RedHotel's infrastructure for malware command-and-control, reconnaissance, and exploitation points to administration in Chengdu, China. Its methods align with other contractor groups linked to China's Ministry of State Security (MSS), indicating a
https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/https://wiki.zimbra.com/wiki/Security_Centerhttps://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30https://wiki.zimbra.com/wiki/Zimbra_Security_Advisorieshttps://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/https://wiki.zimbra.com/wiki/Security_Centerhttps://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30https://wiki.zimbra.com/wiki/Zimbra_Security_Advisorieshttps://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24682
2022-02-09
Published
2022-02-25
Added to CISA KEV
Exploited in the wild