Unauthenticated Command Execution Vulnerability in Zimbra Collaboration

CVE-2024-45519

9.8CRITICAL

Key Information

Vendor: Zimbra
Status: Collaboration
Vendor: CVE Published:; 2 October 2024

🥇 Trended No. 1📈 Trended📈 Score: 13,200💰 Ransomware👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2024-45519?

CVE-2024-45519 is a critical vulnerability affecting the Zimbra Collaboration Suite (ZCS), a platform widely used for email and collaboration services within organizations. This vulnerability specifically exists in the postjournal service, which can inadvertently grant unauthenticated users the ability to execute arbitrary commands. Such unauthorized command execution poses a significant threat to organizations, as it can lead to potential system breaches, unauthorized access, and compromise of sensitive data and operations.

Technical Details

This vulnerability impacts various versions of Zimbra Collaboration, specifically those prior to 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1. The issue arises from inadequate access controls in the postjournal service, which allows attackers to execute commands without necessary authentication. This flaw can be exploited by malicious actors to carry out various attacks, potentially leading to severe ramifications for impacted systems.

Impact of the Vulnerability

Unauthorized Command Execution: The most immediate consequence of CVE-2024-45519 is the ability for unauthenticated users to execute arbitrary commands on the Zimbra server, leading to unauthorized access and manipulation of system functions.
Data Breaches: Successful exploitation may result in unauthorized access to sensitive data stored within the Zimbra environment, exposing confidential information and potentially leading to compliance violations and loss of customer trust.
System Compromise: The vulnerability can facilitate deeper system penetration, allowing attackers to escalate their privileges, install malware, or establish persistence within the network, thereby increasing the overall attack surface for further exploits.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-45519 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-45519
Created by Chocapikk

cve-2024-45519-poc
Created by XiaomingX