Introduction

The National Cyber Coordination and Command Centre (NC4) would like to advise organisations to take precautionary measures regarding a newly identified vulnerability (CVE-2024-45519) in Zimbra Collaboration Suites postjournal service. This vulnerability could allow threat actors to execute arbitrary commands, potentially leading to system compromise.

Impact

The Zimbra vulnerability is currently under active exploitation, with observed attacks beginning on 28 September 2024. The exploit utilises command injection in the postjournal service, enabling unauthorised code execution. This poses a risk to any organisation using Zimbra’s email and collaboration platform. Zimbra vulnerabilities are frequently exploited by state-sponsored groups and ransomware gangs, such as MalasLocker, because it is commonly used across government agencies and corporate environments.

Brief Description

CVE-2024-45519 arises from improper handling of unsanitised input in the postjournal binary of Zimbra Collaboration Suite. The vulnerability is triggered by sending specially crafted SMTP messages to Zimbra servers, allowing remote command execution. Proof of Concept (PoC) exploits have been published, demonstrating the severity of this flaw.

The vulnerability is linked to the use of popen within the postjournal service without adequate input sanitisation, creating a potential for command injection. A security expert at Synacor, Zimbra’s parent company, emphasised the importance of applying the patch, even if the postjournal feature is optional or disabled. As a temporary measure, removing the postjournal binary is suggested if immediate patching is not feasible.

Affected Product

Zimbra Collaboration Suite (ZCS) version as below:

• 8 before 8.8.15 Patch 46
• 9 before 9.0.0 Patch 41 
• 10 before 10.0.9, and
• 10.1 before 10.1.1

Recommendation

Organisations are advised to take the following immediate actions to mitigate the risk of exploitation:

1. Apply Security Patches: Update Zimbra with the latest patches to address CVE-2024-45519 and other related vulnerabilities.
2. Disable Postjournal Service: If patching is not immediately possible, disable or remove the postjournal binary as a temporary mitigation.
3. Monitor for Suspicious Activity: Closely monitor network and email traffic, paying particular attention to SMTP messages that could indicate command injection attempts.

References

  https://www.helpnetsecurity.com/2024/10/02/cve-2024-45519-exploited/

  https://blog.projectdiscovery.io/zimbra-remote-code-execution/

  https://nvd.nist.gov/vuln/detail/CVE-2024-45519