Listen to this Post
How the mentioned CVE works
The vulnerability CVE-2024-22130 is a Stored Cross-Site Scripting (XSS) flaw within the Zimbra Collaboration Suite (ZCS) Classic Web Client. The issue originates from insufficient input sanitization of HTML content contained within imported ICS (iCalendar) files. When a user is tricked into receiving a crafted email containing a malicious ICS file attachment and subsequently views this email, the client-side code fails to properly neutralize the embedded scripts. Specifically, JavaScript payloads can be embedded within an `ontoggle` event attribute of a `
` HTML tag found in the ICS content. Upon the user interacting with or simply viewing the rendered email, the malicious JavaScript executes within the context of the victim’s authenticated Zimbra session. This execution grants the attacker the ability to perform any action the user is authorized to do. A primary exploitation vector involves the malicious script automatically creating or modifying email filters to surreptitiously forward the victim’s incoming emails to an attacker-controlled address, leading to significant data exfiltration and account compromise without the victim’s knowledge.
Platform: Zimbra Collaboration Suite
Version: 9.0, 10.0, 10.1`
Platform: Zimbra Collaboration Suite
Version: 9.0, 10.0, 10.1
Vulnerability : Stored XSS
Severity: Critical
date: 2024-01-22
Prediction: Patch by 2024-02-15
What Undercode Say:
`curl -s “https://example.com/zimbra/ics_injection_point” -F “[email protected]”`
`
View Details
View Details
`
`zmprov ma [email protected] amavisBypassSpamChecks TRUE`
How Exploit:
Craft ICS file with JavaScript in ontoggle event.
Send email with malicious ICS attachment.
Victim views email, triggering script execution.
Script auto-creates email forwarding rule.
Protection from this CVE
Apply vendor security patches.
Sanitize all ICS file inputs.
Implement Content Security Policy.
Impact:
Email hijacking via filters.
Full account takeover.
Significant data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
