Loading vulnerability…
CVE-2022-41352 is a path traversal/arbitrary file write vulnerability in Zimbra Collaboration Suite 8.8.15 and 9.0. Zimbra's Amavis attachment-scanning workflow invokes cpio to extract untrusted archive attachments. A crafted cpio, tar, or RPM attachment can exploit cpio path handling to write attacker-controlled files outside the intended extraction location, subject to the permissions of the Zimbra service account. Attackers can place a server-side web shell in a web-accessible Zimbra location and obtain remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module targeting CVE-2022-41352, a TAR path traversal vulnerability in Zimbra Collaboration Suite. The exploit abuses a flaw in the cpio utility (CVE-2015-1197) to plant a malicious JSP webshell in the Zimbra web root by sending a crafted .tar file as an email attachment to a user on the target server. The module generates the malicious archive, which, when processed by the vulnerable Zimbra server, results in the webshell being written to a publicly accessible directory (default: /opt/zimbra/jetty_base/webapps/zimbra/). The module can then trigger the webshell via HTTP, executing a payload (default: Meterpreter reverse shell). The exploit is operational and provides remote code execution on vulnerable Zimbra servers running on Linux without 'pax' installed. The code is written in Ruby and is structured as a standard Metasploit exploit module, with options for customizing the payload, target path, and filename.
This repository provides a proof-of-concept (PoC) exploit for CVE-2022-41352, a directory traversal vulnerability involving the cpio utility. The main file, cpio_pocgen.py, is a Python script that generates a crafted tar archive (poc.tar). This archive contains a symlink and a file such that, when extracted with cpio in a specific directory structure, it causes a file (here.txt) to be written outside the intended extraction directory, demonstrating the vulnerability. The README.md provides instructions for generating the PoC and reproducing the exploit. The repository is structured with a single code file (cpio_pocgen.py), a binary payload (poc.tar), a README, and a license. The exploit is local in nature, requiring the attacker to supply the crafted archive to a system that processes it with cpio.
This repository contains a Python exploit script (cve-2022-41352.py) targeting CVE-2022-41352, an unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite (versions <9.0.0.p27 and <8.8.15.p34) due to unsafe cpio handling. The exploit works by crafting a malicious tar archive containing a JSP webshell, attaching it to an email, and sending it to the target Zimbra server via SMTP. If the server is vulnerable, the attachment is extracted, and the webshell is written to the Zimbra web directory. The script then verifies the upload by accessing the webshell over HTTPS. Optionally, the script can use the webshell to create a new global administrator account on the Zimbra server. The repository includes a README.md with usage instructions and background information. The main attack vector is network-based, leveraging SMTP and HTTP(S) to deliver and interact with the payload. Key endpoints include the webshell URL and the file paths on the Zimbra server where the payload is written.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in Zimbra Collaboration Suite 8.8.15 and 9.0 that was used by BabLock operators for initial access.
Remote code execution in Zimbra Collaboration Suite triggered by emailing crafted archives that Amavis extracts with cpio, enabling arbitrary file write (e.g., webshell placement) and leading to RCE.
An arbitrary file-write vulnerability in Zimbra Collaboration that allowed deployment of web shells and arbitrary files via specially crafted email attachments, used by the Seashell Blizzard subgroup for command execution and persistence.
A remotely exploitable Zimbra vulnerability related to tar extraction behavior, mentioned as background comparison and noted as added to CISA KEV.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.