CVE-2025-27915
📋 TL;DR
This stored XSS vulnerability in Zimbra Collaboration allows attackers to inject malicious JavaScript via ICS calendar files in emails. When victims view these emails, the JavaScript executes in their session, enabling unauthorized actions like email filter manipulation. Affects Zimbra 9.0, 10.0, and 10.1 users who use the Classic Web Client.
💻 Affected Systems
- Zimbra Collaboration Suite
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover via email filter redirection, leading to data exfiltration, credential theft, and further lateral movement within the organization.
Likely Case
Attackers redirect victim emails to external addresses, intercept sensitive communications, and potentially steal session cookies for account access.
If Mitigated
Limited impact with proper email filtering, user awareness, and network segmentation preventing external communication of stolen data.
🎯 Exploit Status
Exploitation requires sending malicious email to target. Attack chain is simple once malicious ICS file is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.0.0 P44, 10.0.13, 10.1.5
Vendor Advisory: https://wiki.zimbra.com/wiki/Security_Center
Restart Required: Yes
Instructions:
1. Backup Zimbra installation. 2. Download appropriate patch version from Zimbra website. 3. Stop Zimbra services. 4. Apply patch. 5. Restart Zimbra services. 6. Verify patch installation.
🔧 Temporary Workarounds
Disable ICS file processing
allBlock or sanitize ICS file attachments at email gateway
Configure email security gateway to strip or quarantine ICS attachments
Force Modern UI
linuxConfigure Zimbra to use Modern UI/Zimbra Web Client instead of Classic Web Client
zmprov mcf zimbraFeatureModernWebClientEnabled TRUE
zmmailboxdctl restart
🧯 If You Can't Patch
- Implement strict email filtering to block ICS attachments from untrusted sources
- Deploy web application firewall with XSS protection rules specifically for Zimbra endpoints
🔍 How to Verify
Check if Vulnerable:
Check Zimbra version against affected versions. Test by creating ICS file with simple JavaScript payload and sending as email attachment.Check Version:
su - zimbra -c 'zmcontrol -v'Verify Fix Applied:
After patching, attempt the same ICS XSS test - JavaScript should not execute. Check version matches patched releases.📡 Detection & Monitoring
Log Indicators:
- Unusual ICS file attachments in email logs
- Multiple filter creation/modification events from single user session
- JavaScript execution errors in web server logs
Network Indicators:
- Outbound connections to suspicious domains following ICS file views
- Unusual SMTP traffic patterns indicating email forwarding
SIEM Query:
source="zimbra.log" AND ("ICS" OR "calendar" OR "ontoggle") AND ("script" OR "javascript" OR "<details>")🔗 References
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes
- https://strikeready.com/blog/0day-ics-attack-in-the-wild/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915
