CVE-2024-54663
📋 TL;DR
This CVE describes a Local File Inclusion vulnerability in Zimbra Collaboration's Webmail Classic UI. Authenticated attackers can access sensitive files in the WebRoot directory by crafting malicious requests to the /h/rest endpoint. Organizations running affected Zimbra versions with Webmail Classic UI enabled are vulnerable.
💻 Affected Systems
- Zimbra Collaboration (ZCS)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive configuration files, credentials, or other critical system files, potentially leading to full system compromise.
Likely Case
Unauthorized access to sensitive files containing configuration data, logs, or other web-accessible content.
If Mitigated
Limited impact if proper access controls and file permissions are in place, though sensitive information may still be exposed.
🎯 Exploit Status
Requires valid authentication token and knowledge of file paths. Attackers need to be authenticated users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.11, 10.1.3
Vendor Advisory: https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes
Restart Required: Yes
Instructions:
1. Backup your Zimbra installation. 2. Apply the appropriate patch (10.0.11 for ZCS 10.0, 10.1.3 for ZCS 10.1). 3. Restart Zimbra services. 4. Verify the patch is applied correctly.
🔧 Temporary Workarounds
Disable Webmail Classic UI
linuxDisable the vulnerable Webmail Classic UI interface
zmprov mcf zimbraFeatureClassicWebmailEnabled FALSE
zmmailboxdctl restart
Restrict /h/rest endpoint access
allUse web server rules to restrict access to the vulnerable endpoint
Add appropriate deny rules to Apache/Nginx configuration for /h/rest
🧯 If You Can't Patch
- Implement strict access controls and monitoring for the /h/rest endpoint
- Ensure file permissions in WebRoot directory are properly restricted
🔍 How to Verify
Check if Vulnerable:
Check Zimbra version and verify if Webmail Classic UI is enabledCheck Version:
zmcontrol -vVerify Fix Applied:
Verify Zimbra version is 10.0.11 or 10.1.3 or higher, and test that /h/rest endpoint no longer allows file inclusion📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /h/rest endpoint with file path parameters
- Multiple failed file inclusion attempts
Network Indicators:
- HTTP requests to /h/rest with suspicious file paths
- Unusual traffic patterns from authenticated users
SIEM Query:
source="zimbra_access.log" AND uri_path="/h/rest" AND (file_path="*" OR param="*file*")