CVE-2024-45510
📋 TL;DR
This stored XSS vulnerability in Zimbra Collaboration allows attackers to inject malicious JavaScript into email fields. When victims add attacker-controlled contacts, the code executes in their webmail session, potentially enabling unauthorized email sending, data theft, and account manipulation. All Zimbra Collaboration users with Modern UI are affected.
💻 Affected Systems
- Zimbra Collaboration Suite
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account compromise allowing attackers to send emails as the victim, exfiltrate all mailbox contents, modify account settings, and maintain persistent access.
Likely Case
Attackers send phishing emails from victim's account, steal sensitive emails, and modify contact information to maintain access.
If Mitigated
No impact if proper input sanitization is implemented or if the vulnerability is patched.
🎯 Exploit Status
Requires user interaction (adding contact) but exploitation is straightforward once malicious email is received
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.9, 10.1.1, or 9.0.0 Patch 41
Vendor Advisory: https://wiki.zimbra.com/wiki/Security_Center
Restart Required: Yes
Instructions:
1. Backup your Zimbra installation. 2. Download appropriate patch version from Zimbra website. 3. Stop Zimbra services. 4. Apply the patch. 5. Restart Zimbra services. 6. Verify the update.
🔧 Temporary Workarounds
Disable Modern UI
linuxSwitch to Classic UI which may not be vulnerable
zmprov mcf zimbraFeatureModernUIEnabled FALSE
zmmailboxdctl restart
Input Filtering
allImplement WAF rules to filter suspicious HTML/JavaScript in contact fields
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to limit script execution
- Educate users about risks of adding unknown contacts and suspicious email content
🔍 How to Verify
Check if Vulnerable:
Check Zimbra version against affected versions. Test by attempting to inject script tags in contact fields.Check Version:
zmcontrol -vVerify Fix Applied:
Verify Zimbra version is 10.0.9, 10.1.1, or 9.0.0 P41 or later. Test XSS payloads no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual contact additions
- JavaScript execution in contact fields
- Multiple failed XSS attempts
Network Indicators:
- Unexpected outbound emails from user accounts
- Unusual data exfiltration patterns
SIEM Query:
source="zimbra.log" AND ("contact.add" OR "script" OR "javascript")🔗 References
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
