Technical details have emerged about a high-severity vulnerability affecting certain versions of the email solution Zimbra that hackers could exploit to steal logins without authentication or user interaction
The security issue is currently tracked as CVE-2022-27924 and affects Zimbra versions 8.8.x and 9.x for both the open source and commercial versions of the platform.
A fix has been released in Zimbra ZCS 9.0.0 Patch 24.1 and ZCS 8.8.15 Patch 31.1, available as of May 10, 2022. Zimbra is widely used by organizations around the world, including those in the government, financial , and education sectors.
See also: Cisco Secure Email: Bug allows authentication bypass
The flaw has been described in a report by researchers at SonarSource, who summarized it as “Memcached poisoning with an unauthenticated request.” Exploitation is possible via a CRLF injection into the username of Memcached queries.
Memcached is an internal-service instance that stores key/value pairs for email accounts to improve Zimbra performance by reducing the number of HTTP requests to the Lookup Service. Memcache sets and retrieves these pairs using a simple text-based protocol
The researchers explain that a malicious actor could replace the IMAP route entries for a known username via a specially crafted HTTP request to the vulnerable Zimbra instance. Then, when the real user logs in, the Nginx Proxy in Zimbra will forward all IMAP traffic to the attacker, including the credentials in plain text.
"Typically, mail clients such as Thunderbird, Microsoft Outlook, the macOS Mail app, and Smartphone mail apps store the credentials the user used to connect to their IMAP server on disk," SonarSource explains in the report, emphasizing that the exploit does not require any user interaction.
See also: Old Telerik flaws exploited for Cobalt Strike development
"When the Mail client restarts or needs to reconnect, which may happen periodically, it will re-identify itself to the targeted Zimbra instance," the researchers add.
Knowing the victim's email, information that is usually easy to find, and using an IMAP client allows the attacker to exploit the vulnerability more easily.
A second exploitation technique allows bypassing the above restrictions to steal credentials for any user without interaction and without any knowledge about the Zimbra instance.
This is achieved through “Response Smuggling”, an alternative route that leverages the use of a web-based client for Zimbra.
This way, an attacker could compromise the proxy connection of random users whose email addresses are unknown, without requiring any interaction and/or generating alerts for the victim.
Correction and timing
SonarSource disclosed its findings to Zimbra on March 11, 2022. An initial patch was released on March 31, 2022, but it was insufficient to resolve the issue.
On May 10, the company addressed the issues via ZCS 9.0.0 Patch 24.1 and ZCS 8.8.15 Patch 31.1, generating a SHA-256 hash of all Memcache keys before they are sent to the server.
SHA-256 cannot contain spaces, so new lines cannot be created for CRLF injection and poisoning attacks cannot be performed on the patched versions.
See also: New Go botnet Panchan spreads rapidly across educational networks
It is worth noting that Zimbra yesterday released ZCS 9.0.0 Patch 25 and ZCS 8.8.15 Patch 32 patch updates with an update to OpenSSL 1.1.1n, which addresses an infinite loop vulnerability causing denial of service, which is tracked as CVE-2022-0778.
Information source: bleepingcomputer.com
