Loading vulnerability…
CVE-2022-37042 is an authentication bypass vulnerability in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 affecting the MailboxImportServlet and the mboximport functionality. The vulnerable feature accepts a ZIP archive and extracts its contents. Due to an incomplete fix for CVE-2022-27925, an attacker can bypass the expected authentication requirement and invoke the import path without a valid authtoken. This allows an unauthenticated attacker to upload arbitrary files to the target system. Because the import and extraction logic can be abused for directory traversal, the flaw can be used to place attacker-controlled files in unintended locations, including locations that enable server-side code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module targeting a ZIP path traversal vulnerability (CVE-2022-27925) in Zimbra Collaboration Suite Network Edition (versions 9.0.0 Patch 23 and earlier, and 8.8.15 Patch 30 and earlier). The exploit works by crafting a ZIP file with path traversal sequences to upload a JSP-based backdoor into the Zimbra admin web directory. The module then triggers the backdoor to achieve remote code execution, typically using a Meterpreter reverse shell payload. The exploit requires access to the Zimbra admin interface (default port 7071, HTTPS) and a valid username (default: admin). The code is written in Ruby and is structured as a standard Metasploit module, making it weaponized and easily customizable. Key endpoints include the vulnerable ZIP upload handler and the web-accessible directory where the backdoor is placed. The module also references related advisories and patches, and is intended for use against Linux-based Zimbra installations.
This repository contains a weaponized Nuclei template (CVE-2022-37042-shell-upload.yaml) for exploiting an unauthenticated remote code execution (RCE) vulnerability in Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 (CVE-2022-37042). The exploit leverages a flaw in the mboximport functionality, allowing an attacker to upload arbitrary files (via directory traversal) without authentication. The provided payload is a JSP web shell (formatter.jsp), which is uploaded to the /public/ directory of the target server. Once uploaded, the attacker can execute arbitrary system commands by sending HTTP requests to /public/formatter.jsp with the 'cmd' parameter. The repository includes a README with usage instructions, example shell URLs, and remediation advice. The main exploit file is a Nuclei template, making this a WEAPONIZED exploit suitable for automated mass exploitation.
This repository is an exploit tool targeting CVE-2022-37042, a remote code execution vulnerability in Zimbra Collaboration Suite versions 8.8.15 and 9.0. The exploit is implemented in Go (main.go) and allows for both vulnerability detection and exploitation. It can scan single or multiple targets for the vulnerability and, if exploitable, uploads a malicious JSP webshell (shell.jsp) to the target server. The webshell is AES-encrypted and password-protected, providing remote code execution capabilities to the attacker. The tool supports command-line options for specifying targets, uploading the webshell, and outputting results. The repository includes build and release configuration files, a detailed README with usage instructions, and the actual exploit code. The main attack vector is network-based, targeting HTTP(S) endpoints of Zimbra servers. The exploit is operational, providing a working payload and automation for exploitation.
This repository contains a proof-of-concept exploit for Zimbra Collaboration Suite vulnerabilities CVE-2022-37042 and CVE-2022-27925. The main file, poc.py, is a Python script that crafts a malicious ZIP archive containing a JSP web shell and uploads it to a vulnerable Zimbra server via the /service/extension/backup/mboximport endpoint. Once uploaded, the shell can be accessed at /zimbraAdmin/shell.jsp, allowing the attacker to execute arbitrary commands on the server. The exploit demonstrates remote code execution by uploading the shell and issuing a 'whoami' command. The repository structure is simple, consisting of a README and the exploit script. The exploit is operational, providing a working payload (JSP web shell) and targeting Zimbra servers accessible over the network.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Synacor vulnerability that CISA KEV’s knownRansomwareCampaignUse field silently flipped to Known during 2025 (evidence of ransomware campaign use).
A vulnerability referenced as part of a Zimbra Collaboration Suite exploitation chain (chained with CVE-2022-27925) associated with RedHotel activity (per CISA-referenced reporting in the content).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.