www.cisa.gov
Open in
urlscan Pro
2a02:26f0:7100:1a9::447a
Public Scan
URL:
https://www.cisa.gov/uscert/ncas/alerts/aa22-228a
Submission: On October 10 via api from IN — Scanned from DE
Submission: On October 10 via api from IN — Scanned from DE
Form analysis 3 forms found in the DOM
<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id1">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form><form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id2">
<table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form>https://public.govdelivery.com/accounts/USDHSCISA/subscribers/qualify
<form action="https://public.govdelivery.com/accounts/USDHSCISA/subscribers/qualify"><label class="visually-hidden" for="email-address-field">Enter your email address</label> <input class="signup-form" id="email-address-field" name="email"
placeholder=" Enter your email address" title="Enter your email address" type="text"><br>
<input class="btn btn-primary" name="submit" title="Sign up for alerts" type="submit" value="Sign Up">
</form>Text Content
Skip to main content
An official website of the United States government Here's how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United
States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share
sensitive information only on official, secure websites.
×
search
CISA.gov Services Report
--------------------------------------------------------------------------------
Toggle navigation
×
search
CISA.gov
Services
Report
CERTMAIN MENU
* Alerts and Tips
* Resources
* Industrial Control Systems
--------------------------------------------------------------------------------
TLP:WHITE
TLP:WHITE
1. National Cyber Awareness System >
2. Alerts >
3. Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite
More Alerts
ALERT (AA22-228A)
THREAT ACTORS EXPLOITING MULTIPLE CVES AGAINST ZIMBRA COLLABORATION SUITE
Original release date: August 16, 2022 | Last revised: September 27, 2022
SUMMARY
Actions for ZCS administrators to take today to mitigate malicious cyber
activity:
• Patch all systems and prioritize patching known exploited vulnerabilities.
• Deploy detection signatures and hunt for indicators of compromise (IOCs).
• If ZCS was compromised, remediate malicious activity.
The Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State
Information Sharing & Analysis Center (MS-ISAC) are publishing this joint
Cybersecurity Advisory (CSA) in response to active exploitation of multiple
Common Vulnerabilities and Exposures (CVEs) against Zimbra Collaboration Suite
(ZCS), an enterprise cloud-hosted collaboration software and email platform.
CVEs currently being exploited against ZCS include:
* CVE-2022-24682
* CVE-2022-27924
* CVE-2022-27925 chained with CVE-2022-37042
* CVE-2022-30333
Cyber threat actors may be targeting unpatched ZCS instances in both government
and private sector networks. CISA and the MS-ISAC strongly urge users and
administrators to apply the guidance in the Recommendations section of this CSA
to help secure their organization’s systems against malicious cyber activity.
CISA and the MS-ISAC encourage organizations who did not immediately update
their ZCS instances upon patch release, or whose ZCS instances were exposed to
the internet, to assume compromise and hunt for malicious activity using the
third-party detection signatures in the Detection Methods section of this CSA.
Organizations that detect potential compromise should apply the steps in the
Incident Response section of this CSA.
Update September 27, 2022:
This CSA has been updated with additional IOCs. For a downloadable copy of the
IOCs, see the following Malware Analysis Reports (MARs):
* MAR-10400779-1
* MAR-10400779-2
* MAR-10401765-1
Update End
Download the PDF version of this report: pdf, 427 kb
Download the IOCs: .stix 14 kb
TECHNICAL DETAILS
CVE-2022-27924
CVE-2022-27924 is a high-severity vulnerability enabling an unauthenticated
malicious actor to inject arbitrary memcache commands into a targeted ZCS
instance and cause an overwrite of arbitrary cached entries. The actor can then
steal ZCS email account credentials in cleartext form without any user
interaction. With valid email account credentials in an organization not
enforcing multifactor authentication (MFA), a malicious actor can use spear
phishing, social engineering, and business email compromise (BEC) attacks
against the compromised organization. Additionally, malicious actors could use
the valid account credentials to open webshells and maintain persistent access.
On March 11, 2022, researchers from SonarSource announced the discovery of this
ZCS vulnerability. Zimbra issued fixes for releases 8.8.15 and 9.0 on May 10,
2022. Based on evidence of active exploitation, CISA added this vulnerability to
the Known Exploited Vulnerabilities Catalog on August 4, 2022. Due to ease of
exploitation, CISA and the MS-ISAC expect to see widespread exploitation of
unpatched ZCS instances in government and private networks.
CVE-2022-27925 AND CVE-2022-37042
CVE-2022-27925 is a high severity vulnerability in ZCS releases 8.8.15 and 9.0
that have mboximport functionality to receive a ZIP archive and extract files
from it. An authenticated user has the ability to upload arbitrary files to the
system thereby leading to directory traversal.[1] On August 10, 2022,
researchers from Volexity reported widespread exploitation—against over 1,000
ZCS instances—of CVE-2022-27925 in conjunction with CVE-2022-37042.[2(link is
external)] CISA added both CVEs to the Known Exploited Vulnerabilities Catalog
on August 11, 2022.
CVE 2022 37042 is an authentication bypass vulnerability that affects ZCS
releases 8.8.15 and 9.0. CVE 2022 37042 could allow an unauthenticated malicious
actor access to a vulnerable ZCS instance. According to Zimbra, CVE 2022 37042
is found in the MailboxImportServlet function.[3][4(link is external)] Zimbra
issued fixes in late July 2022.
CVE-2022-30333
CVE-2022-30333 is a high-severity directory traversal vulnerability in RARLAB
UnRAR on Linux and UNIX allowing a malicious actor to write to files during an
extract (unpack) operation. A malicious actor can exploit CVE-2022-30333 against
a ZCS server by sending an email with a malicious RAR file. Upon email receipt,
the ZCS server would automatically extract the RAR file to check for spam or
malware.[5(link is external)] Any ZCS instance with unrar installed is
vulnerable to CVE-2022-30333.
Researchers from SonarSource shared details about this vulnerability in June
2022.[6] Zimbra made configuration changes to use the 7zip program instead of
unrar.[7] CISA added CVE-2022-3033 to the Known Exploited Vulnerabilities
Catalog on August 9, 2022. Based on industry reporting, a malicious cyber actor
is selling a cross-site scripting (XSS) exploit kit for the ZCS vulnerability to
CVE 2022 30333. A Metasploit module is also available that creates a RAR file
that can be emailed to a ZCS server to exploit CVE-2022-30333.[8(link is
external)]
CVE-2022-24682
CVE-2022-24682 is a medium-severity vulnerability that impacts ZCS webmail
clients running releases before 8.8.15 patch 30 (update 1), which contain a
cross-site scripting (XSS) vulnerability allowing malicious actors to steal
session cookie files. Researchers from Volexity shared this vulnerability on
February 3, 2022[9(link is external)], and Zimbra issued a fix on February 4,
2022.[10(link is external)] CISA added this vulnerability to the Known Exploited
Vulnerabilities Catalog on February 25, 2022.
DETECTION METHODS
Note: CISA and the MS-ISAC will update this section with additional IOCs and
signatures as further information becomes available.
CISA recommends administrators, especially at organizations that did not
immediately update their ZCS instances upon patch release, to hunt for malicious
activity using the following third-party detection signatures:
* Update September 27, 2022: Hunt for IOCs including:
IP Addresses
Note
62.113.255[.]70
New September 27, 2022: Used by cyber actors during August 25-26, 2022 while
attempting to exploit CVE-2022-27925 and CVE-2022-37042
185.112.83[.]77
New September 27, 2022: Used by cyber actors during August 25-26, 2022 while
attempting to exploit CVE-2022-27925 and CVE-2022-37042
207.148.76[.]235
A Cobalt Strike command and control (C2) domain
209.141.56[.]190
New September 27, 2022
* Update August 23, 2022: Deploy Snort signatures to detect malicious activity:
alert tcp any any -> any any (msg:"ZIMBRA: HTTP POST content data '.jsp' file'";
sid:x; flow:established,to_server; content:"POST"; http_method;
content:"|2f|service|2f|extension|2f|backup|2f|mboximport"; nocase; http_uri;
content:"file|3a|"; nocase; http_client_body; content:"|2e|jsp";
http_client_body; fast_pattern; classtype:http-content;
reference:cve,2022-30333;)
alert tcp any any -> any any (msg:"ZIMBRA: Client HTTP Header 'QIHU 360SE'";
sid:x; flow:established,to_server; content:"POST"; http_method;
content:"|2f|service|2f|extension|2f|backup|2f|mboximport"; nocase; http_uri;
content:"QIHU|20|360SE"; nocase; http_header; fast_pattern;
classtype:http-header; reference:cve,2022-30333;)
alert tcp any any -> any any (msg:"ZIMBRA:HTTP GET URI for Zimbra Local Config";
sid:x; flow:established,to_server;
content:"/public/jsp/runas.jsp?pwd=zim&i=/opt/zimbra/bin/zmlocalconfig|3a|-s";
http_uri; classtype:http-uri; reference:cve,2022-30333;)
* Deploy third-party YARA rules to detect malicious activity:
* See Volexity’s Mass Exploitation of (Un)authenticated Zimbra RCE:
CVE-2022-27925
MITIGATIONS
CISA and the MS-ISAC recommend organizations upgrade to the latest ZCS releases
as noted on Zimbra Security – News & Alerts(link is external) and Zimbra
Security Advisories(link is external).
See Volexity’s Mass Exploitation of (Un)authenticated Zimbra RCE:
CVE-2022-27925(link is external) for mitigation steps.
Additionally, CISA and the MS-ISAC recommend organizations apply the following
best practices to reduce risk of compromise:
* Maintain and test an incident response plan.
* Ensure your organization has a vulnerability management program in place and
that it prioritizes patch management and vulnerability scanning of known
exploited vulnerabilities. Note: CISA’s Cyber Hygiene Services (CyHy) are
free to all state, local, tribal, and territorial (SLTT) organizations, as
well as public and private sector critical infrastructure organizations:
cisa.gov/cyber-hygiene-services.
* Properly configure and secure internet-facing network devices.
* Do not expose management interfaces to the internet.
* Disable unused or unnecessary network ports and protocols.
* Disable/remove unused network services and devices.
* Adopt zero-trust principles and architecture, including:
* Micro-segmenting networks and functions to limit or block lateral
movements.
* Enforcing phishing-resistant (MFA) for all users and virtual private
network (VPN) connections.
* Restricting access to trusted devices and users on the networks.
INCIDENT RESPONSE
If an organization’s system has been compromised by active or recently active
threat actors in their environment, CISA and the MS-ISAC recommend the following
initial steps:
1. Collect and review artifacts, such as running processes/services, unusual
authentications, and recent network connections.
2. Quarantine or take offline potentially affected hosts.
3. Reimage compromised hosts.
4. Provision new account credentials.
5. Report the compromise to CISA via CISA’s 24/7 Operations Center
(report@cisa.gov(link sends email) or 888-282-0870). SLTT government
entities can also report to the MS-ISAC (SOC@cisecurity.org(link sends
email) or 866-787-4722).
See the joint CSA from the cybersecurity authorities of Australia, Canada, New
Zealand, the United Kingdom, and the United States on Technical Approaches to
Uncovering and Remediating Malicious Activity for additional guidance on hunting
or investigating a network, and for common mistakes in incident handling. CISA
and the MS-ISAC also encourage government network administrators to see CISA’s
Federal Government Cybersecurity Incident and Vulnerability Response Playbooks.
Although tailored to federal civilian branch agencies, these playbooks provide
detailed operational procedures for planning and conducting cybersecurity
incident and vulnerability response activities.
ACKNOWLEDGEMENTS
CISA and the MS-ISAC would like to thank Volexity and Secureworks for their
contributions to this advisory.
DISCLAIMER
The information in this report is being provided “as is” for informational
purposes only. CISA and the MS-ISAC do not provide any warranties of any kind
regarding this information. CISA and the MS-ISAC do not endorse any commercial
product or service, including any subjects of analysis. Any reference to
specific commercial products, processes, or services by service mark, trademark,
manufacturer, or otherwise, does not constitute or imply endorsement,
recommendation, or favoring.
REFERENCES
[1] CVE-2022-27925 detail
[2] Mass exploitation of (un)authenticated Zimbra RCE: CVE-2022-27925(link is
external)
[3] CVE-2022-37042 detail
[4] Authentication bypass in MailboxImportServlet vulnerability(link is
external)
[5] CVE-2022-30333 detail
[6] UnRAR vulnerability exploited in the wild, likely against Zimbra
servers(link is external)
[7] Zimbra Collaboration Kepler 9.0.0 patch 25 GA release(link is external)
[8] Zimbra UnRAR path traversal(link is external)
[9] Operation EmailThief: Active exploitation of zero-day XSS vulnerability in
…(link is external)
[10] Hotfix available 5 Feb for zero-day exploit vulnerability in Zimbra
8.8.15(link is external)
REVISIONS
August 16, 2022: Initial Version
August 22, 2022: Added Snort Signatures
August 23, 2022: Updated Detection Methods Snort Signatures
This product is provided subject to this Notification and this Privacy & Use
policy.
Please share your thoughts.
We recently updated our anonymous product survey; we'd welcome your feedback.
CONTACT US
(888)282-0870
Send us email(link sends email)
Download PGP/GPG keys
Submit website feedback
SUBSCRIBE TO ALERTS
Receive security alerts, tips, and other updates.
Enter your email address
HSIN
Report
--------------------------------------------------------------------------------
Home Site Map FAQ Contact Us Traffic Light Protocol PCII
Accountability Disclaimer Privacy Policy FOIA No Fear Act
AccessibilityPlain WritingPlug-ins Inspector General The White House
USA.gov
CISA is part of the Department of Homeland Security