Loading vulnerability…
CVE-2022-27925 is a directory traversal vulnerability in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 in the mboximport functionality that accepts a ZIP archive and extracts its contents on the server. An authenticated administrator can supply a crafted ZIP archive containing path traversal sequences so that extracted files are written outside the intended destination directory. Because the vulnerable import logic permits arbitrary file upload and insufficiently restricts extraction paths, an attacker can place files in attacker-chosen locations on the system. The flaw has been observed in real-world exploitation and has been reported as chained with CVE-2022-37042, an authentication bypass in ZCS, to remove the need for valid administrator credentials.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
8 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small Python-based exploit for CVE-2022-27925 affecting Zimbra Collaboration Suite Network Edition. It contains three files: LICENSE, README.md, and a single executable script, main.py. The README identifies the target product and vulnerable versions, gives a search dork for finding exposed Zimbra login pages, and shows usage as 'python3 main.py <list.txt> <output> <command>'. The main exploit logic is entirely in main.py. It is not just a detector: it attempts full remote code execution. The script reads a list of target base URLs, spawns a thread per target, and for each host builds an in-memory ZIP archive containing a randomly named JSP payload. That payload is a web shell which accepts a 'cmd' parameter and executes it with '/bin/sh -c', returning stdout and stderr to the HTTP response. Exploitation works by abusing the Zimbra backup import extension endpoint '/service/extension/backup/mboximport?account-name=admin&ow=2&no-switch=1&append=1'. The ZIP entry name is crafted with path traversal sequences to try writing the JSP into one of three candidate admin webapp directories: '../../../../mailboxd/webapps/zimbraAdmin/', '../../../../jetty_base/webapps/zimbraAdmin/', and '../../../../jetty/webapps/zimbraAdmin/'. After upload, the script requests '/zimbraAdmin/<random>.jsp?cmd=<command>' to trigger the shell. If the response returns HTTP 200, it reports success and appends the host to the specified output file. Operationally, this is a basic but functional exploit with a hardcoded JSP payload and operator-supplied command execution. It lacks robust error handling and verification beyond checking for HTTP 200, but its purpose is clear: mass exploitation of vulnerable Zimbra servers for arbitrary command execution via uploaded JSP web shells.
This repository contains a Python exploit for CVE-2022-27925, a remote code execution vulnerability in Zimbra Collaboration Suite Network Edition (versions 9.0.0 Patch 23 and earlier, and 8.8.15 Patch 30 and earlier). The exploit works by uploading a malicious JSP webshell to the Zimbra server using a crafted ZIP archive and a vulnerable import endpoint. The main exploit logic is in 'main.py', which reads a list of target servers, attempts to upload the webshell to several possible directories using path traversal, and then accesses the webshell to execute arbitrary commands provided by the user. The payload is a JSP webshell that executes system commands via the 'cmd' parameter. The attack is performed over HTTP/HTTPS and targets the '/service/extension/backup/mboximport' endpoint for the upload, and '/zimbraAdmin/<random>.jsp' for command execution. The repository is operational and provides a working exploit with a hardcoded payload. The structure is simple, with a single code file, a README with usage instructions, and a license.
This repository contains a single Metasploit module targeting a ZIP path traversal vulnerability (CVE-2022-27925) in Zimbra Collaboration Suite Network Edition (versions 9.0.0 Patch 23 and earlier, and 8.8.15 Patch 30 and earlier). The exploit works by crafting a ZIP file with path traversal sequences to upload a JSP-based backdoor into the Zimbra admin web directory. The module then triggers the backdoor to achieve remote code execution, typically using a Meterpreter reverse shell payload. The exploit requires access to the Zimbra admin interface (default port 7071, HTTPS) and a valid username (default: admin). The code is written in Ruby and is structured as a standard Metasploit module, making it weaponized and easily customizable. Key endpoints include the vulnerable ZIP upload handler and the web-accessible directory where the backdoor is placed. The module also references related advisories and patches, and is intended for use against Linux-based Zimbra installations.
This repository contains a Nuclei template (CVE-2022-27925.yaml) for exploiting CVE-2022-27925, a critical unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0. The template sends a crafted POST request to the /service/extension/backup/mboximport endpoint, uploading a ZIP archive that leverages directory traversal to place a JSP webshell (cmd.jsp) in the webapps directory. The template then issues a GET request to the webshell, executing a command (e.g., 'cat /etc/passwd') and checks for evidence of successful command execution. The repository structure is minimal, consisting of the Nuclei YAML template and a brief README. The main exploit file is the YAML template, which automates the exploitation process and verification of successful code execution. No hardcoded IPs or domains are present; the template is parameterized for use against arbitrary targets.
This repository contains a Python exploit (exploit.py) targeting CVE-2022-27925 and CVE-2022-37042 in Zimbra Collaboration Suite Network Edition. The exploit leverages a path traversal vulnerability in the mboximport endpoint, combined with an authentication bypass, to upload a JSP webshell to the Zimbra server. The attacker can then interact with the webshell to execute arbitrary commands on the server. The exploit supports both single-target and multi-target modes, reading targets from a file. The README provides detailed background on the vulnerabilities, affected versions, and usage instructions. The main exploit logic is in exploit.py, which constructs a malicious ZIP file containing the webshell, uploads it via the vulnerable endpoint, and verifies successful exploitation by accessing the deployed webshell. The exploit is operational and provides remote command execution as the Zimbra user, with the potential for privilege escalation to root using a separate local exploit. No detection-only scripts are present; the code is a working exploit. The only code file is exploit.py, written in Python, and the repository is structured with standard supporting files (.gitignore, LICENSE, README.md). The main attack vector is network-based, targeting HTTPS endpoints exposed by vulnerable Zimbra servers.
This repository is a proof-of-concept exploit for CVE-2022-27925, a remote code execution vulnerability in Zimbra Collaboration Suite. The main file, 'zimbra-exploit.py', is a Python script that attempts to upload a malicious ZIP file (containing a JSP web shell) to a vulnerable Zimbra server via the '/service/extension/backup/mboximport' endpoint. The script requires the attacker to provide the target URL and a valid email address as arguments. After uploading, it checks for the presence of the web shell at '/zimbraAdmin/cmd.jsp'. The repository consists of a README and the exploit script; the ZIP files referenced as payloads are expected to be present in the working directory. The exploit leverages network access to the Zimbra server and targets endpoints that are specific to the Zimbra backup import functionality.
This repository contains a Python exploit script (exp.py) targeting Zimbra Collaboration Suite servers vulnerable to CVE-2022-27925, an unauthenticated remote code execution flaw. The exploit works by crafting a malicious ZIP file containing a JSP webshell or reverse shell, which is uploaded to the server via a vulnerable mboximport endpoint. The script supports both single-target and mass exploitation modes, and can deploy either a webshell (for arbitrary command execution via HTTP) or a reverse shell (connecting back to the attacker's machine). The README provides usage instructions and describes the required parameters. The main code file is exp.py, which handles argument parsing, payload generation, exploitation logic, and result verification. The exploit is operational and provides real remote code execution if the target is vulnerable.
This repository contains a proof-of-concept exploit for Zimbra Collaboration Suite vulnerabilities CVE-2022-37042 and CVE-2022-27925. The main file, poc.py, is a Python script that crafts a malicious ZIP archive containing a JSP web shell and uploads it to a vulnerable Zimbra server via the /service/extension/backup/mboximport endpoint. Once uploaded, the shell can be accessed at /zimbraAdmin/shell.jsp, allowing the attacker to execute arbitrary commands on the server. The exploit demonstrates remote code execution by uploading the shell and issuing a 'whoami' command. The repository structure is simple, consisting of a README and the exploit script. The exploit is operational, providing a working payload (JSP web shell) and targeting Zimbra servers accessible over the network.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A known publicly exploitable vulnerability affecting Zimbra Collaboration Suite that attackers were observed scanning and exploiting in the StrikeShark campaign.
A Zimbra Collaboration Suite vulnerability listed as weaponized by the threat actor.
A Zimbra Collaboration Suite vulnerability listed among those targeted by the threat actor.
A Zimbra Collaboration Suite vulnerability referenced by the group among CVEs discussed or used as proof-of-concept exploits.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.