CVE-2019-9621 : Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, an

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

Published 2019-04-30 18:29:09

Updated 2019-06-06 20:29:03

Source MITRE

View at NVD, CVE.org

Vulnerability category: Server-side request forgery (SSRF)

Products affected by CVE-2019-9621

Zimbra » Collaboration Server
Versions from including (>=) 8.8.0 and before (<) 8.8.10
cpe:2.3:a:zimbra:collaboration_server:*:*:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server
Versions from including (>=) 8.7.0 and before (<) 8.7.11
cpe:2.3:a:zimbra:collaboration_server:*:*:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server
Versions before (<) 8.6.0
cpe:2.3:a:zimbra:collaboration_server:*:*:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P4
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p4:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P5
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p5:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P12
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p12:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P7
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p7:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P8
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p8:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.10 Update P4
cpe:2.3:a:zimbra:collaboration_server:8.8.10:p4:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.10 Update P5
cpe:2.3:a:zimbra:collaboration_server:8.8.10:p5:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P6
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p6:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P7
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p7:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11
cpe:2.3:a:zimbra:collaboration_server:8.7.11:-:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P1
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p1:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P9
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p9:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.10 Update P6
cpe:2.3:a:zimbra:collaboration_server:8.8.10:p6:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.11
cpe:2.3:a:zimbra:collaboration_server:8.8.11:-:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P2
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p2:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P3
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p3:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P10
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p10:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P11
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p11:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P4
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p4:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P5
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p5:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P6
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p6:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.10 Update P2
cpe:2.3:a:zimbra:collaboration_server:8.8.10:p2:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.10 Update P3
cpe:2.3:a:zimbra:collaboration_server:8.8.10:p3:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0
cpe:2.3:a:zimbra:collaboration_server:8.6.0:-:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P1
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p1:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P8
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p8:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.6.0 Update P9
cpe:2.3:a:zimbra:collaboration_server:8.6.0:p9:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P2
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p2:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.7.11 Update P3
cpe:2.3:a:zimbra:collaboration_server:8.7.11:p3:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.10
cpe:2.3:a:zimbra:collaboration_server:8.8.10:-:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.10 Update P1
cpe:2.3:a:zimbra:collaboration_server:8.8.10:p1:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.11 Update P1
cpe:2.3:a:zimbra:collaboration_server:8.8.11:p1:*:*:*:*:*:*
Matching versions
Zimbra » Collaboration Server » Version: 8.8.11 Update P2
cpe:2.3:a:zimbra:collaboration_server:8.8.11:p2:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-9621

EPSS FAQ

77.03%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2019-9621

Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF

Disclosure Date: 2019-03-13

First seen: 2020-04-26

exploit/linux/http/zimbra_xxe_rce

This module exploits an XML external entity vulnerability and a server side request forgery to get unauthenticated code execution on Zimbra Collaboration Suite. The XML external entity vulnerability in the Autodiscover Servlet is used to read a Zimbra configuration

More information

CVSS scores for CVE-2019-9621

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2019-9621

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-9621

https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html

tint0: A Saga of Code Executions on Zimbra
Third Party Advisory
http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html

Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://blog.zimbra.com/2019/03/9826/

[REPOST] Recent Zimbra XXE / SSRF Vulnerability Disclosure - Zimbra : Blog
Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Zimbra Security Advisories - Zimbra :: Tech Center
Vendor Advisory

CVEs referencing this url
https://wiki.zimbra.com/wiki/Security_Center

Security Center - Zimbra :: Tech Center
Release Notes;Vendor Advisory

CVEs referencing this url
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce

Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF | Rapid7
Exploit;Third Party Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/46693/

Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://bugzilla.zimbra.com/show_bug.cgi?id=109127

Bug 109127 – SSRF vulnerability - ProxyServlet [CWE-918 / CWE-807]
http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html

Zimbra XML Injection / Server-Side Request Forgery ≈ Packet Storm

Jump to