Loading vulnerability…
CVE-2022-41352 is a critical remote code execution vulnerability affecting Zimbra Collaboration Suite 8.8.15 and 9.0. The flaw originates in the Amavis antivirus scanning workflow used for inbound email attachments. When Amavis processes crafted archive attachments, it can invoke cpio to extract untrusted content without safely constraining extraction paths. This allows an unauthenticated remote attacker to send a specially crafted email attachment, including cpio, tar, or rpm archive formats, and cause arbitrary file write to filesystem locations writable by the Zimbra service account. Reported exploitation included writing attacker-controlled files into the Zimbra web application tree, enabling deployment of web shells and subsequent remote code execution. The issue is closely related to unsafe archive extraction behavior and is especially exposed on systems where pax is absent and Amavis falls back to cpio.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module targeting CVE-2022-41352, a TAR path traversal vulnerability in Zimbra Collaboration Suite. The exploit abuses a flaw in the cpio utility (CVE-2015-1197) to plant a malicious JSP webshell in the Zimbra web root by sending a crafted .tar file as an email attachment to a user on the target server. The module generates the malicious archive, which, when processed by the vulnerable Zimbra server, results in the webshell being written to a publicly accessible directory (default: /opt/zimbra/jetty_base/webapps/zimbra/). The module can then trigger the webshell via HTTP, executing a payload (default: Meterpreter reverse shell). The exploit is operational and provides remote code execution on vulnerable Zimbra servers running on Linux without 'pax' installed. The code is written in Ruby and is structured as a standard Metasploit exploit module, with options for customizing the payload, target path, and filename.
This repository provides a proof-of-concept (PoC) exploit for CVE-2022-41352, a directory traversal vulnerability involving the cpio utility. The main file, cpio_pocgen.py, is a Python script that generates a crafted tar archive (poc.tar). This archive contains a symlink and a file such that, when extracted with cpio in a specific directory structure, it causes a file (here.txt) to be written outside the intended extraction directory, demonstrating the vulnerability. The README.md provides instructions for generating the PoC and reproducing the exploit. The repository is structured with a single code file (cpio_pocgen.py), a binary payload (poc.tar), a README, and a license. The exploit is local in nature, requiring the attacker to supply the crafted archive to a system that processes it with cpio.
This repository contains a Python exploit script (cve-2022-41352.py) targeting CVE-2022-41352, an unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite (versions <9.0.0.p27 and <8.8.15.p34) due to unsafe cpio handling. The exploit works by crafting a malicious tar archive containing a JSP webshell, attaching it to an email, and sending it to the target Zimbra server via SMTP. If the server is vulnerable, the attachment is extracted, and the webshell is written to the Zimbra web directory. The script then verifies the upload by accessing the webshell over HTTPS. Optionally, the script can use the webshell to create a new global administrator account on the Zimbra server. The repository includes a README.md with usage instructions and background information. The main attack vector is network-based, leveraging SMTP and HTTP(S) to deliver and interact with the payload. Key endpoints include the webshell URL and the file paths on the Zimbra server where the payload is written.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in Zimbra Collaboration Suite 8.8.15 and 9.0 that was used by BabLock operators for initial access.
Remote code execution in Zimbra Collaboration Suite triggered by emailing crafted archives that Amavis extracts with cpio, enabling arbitrary file write (e.g., webshell placement) and leading to RCE.
An arbitrary file-write vulnerability in Zimbra Collaboration that allowed deployment of web shells and arbitrary files via specially crafted email attachments, used by the Seashell Blizzard subgroup for command execution and persistence.
A remotely exploitable Zimbra vulnerability related to tar extraction behavior, mentioned as background comparison and noted as added to CISA KEV.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.