Researchers Demonstrate Email-Based Attacks on Zimbra Servers
· 42:55 · Watch on YouTube ↗
Summary
Thomas Chauchefoin presents Zimbra research covering email-triggered cross-site scripting, credential theft through cache poisoning, and server compromise through a flaw in archive extraction.
Key points
- A frontend transformation could undo HTML sanitization, allowing JavaScript execution when a user opened a crafted email.
- The researchers chained the scripting flaw with an authenticated server-side request forgery issue to reach other services.
- Newline injection into cache requests could redirect IMAP and POP3 traffic to an attacker-controlled server and expose users’ credentials.
- A flaw in archive extraction allowed a crafted email attachment to write files outside the extraction directory without the recipient opening the message.
- The researchers demonstrated a web shell and discussed ways to gain root privileges after compromising the Zimbra service account.
- The speaker said the archive extractor was patched and Zimbra changed its extraction configuration, but noted that strong privilege separation was still absent.
- A separate targeted attack using cpio archives was reported on a Zimbra forum, according to the speaker.
Article Details
- Topics
- [01:54] Mail server exposure and previously reported Zimbra attacks
- [05:21] Research findings and Zimbra attack surfaces
- [06:13] Email sanitization and mutation-based cross-site scripting
- [12:28] Chaining cross-site scripting with server-side request forgery
- [15:26] Cache injection and credential theft through mail traffic redirection
- [28:14] Archive extraction path traversal and email-triggered server compromise
- [37:46] Persistence, privilege escalation, and disclosure
- [41:37] Reported cpio archive exploitation and remediation