Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-25
• Known to be used in ransomware campaigns
• EPSS: 31% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 11 Mar 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zi…Vendor Advisory
• wiki.zimbra.com/wiki/Security_CenterVendor Advisory
• wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30Release NotesVendor Advisory
• wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-x…ExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource