Loading vulnerability…
Unauthenticated command injection in Zimbra Collaboration postjournal
CVE-2024-45519 is an OS command injection vulnerability in the postjournal email journaling and archiving service of Zimbra Collaboration. Improper sanitization of SMTP input allows unauthenticated attackers to execute arbitrary commands by sending specially crafted emails to a vulnerable server. Observed exploitation uses Base64-encoded payloads in email CC fields. Commands execute in the context of the Zimbra user. Affected releases include 8.8.15 before Patch 46, 9.0.0 before Patch 41, 10.0 before 10.0.9, and 10.1 before 10.1.1. Active exploitation has included deployment of webshells.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits remote command execution with the privileges of the Zimbra user, potentially compromising server data confidentiality and integrity. Attackers can deploy webshells for persistent remote access and further arbitrary code execution. Privilege escalation and full system compromise are possible follow-on outcomes, but elevated privileges are not established as an inherent result of exploitation.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the postjournal service and restrict access to trusted IP addresses using the mynetworks parameter. Reduce exposure of internet-facing Zimbra servers, enforce least privilege for Zimbra services, and segment them from internal networks. Monitor for exploitation attempts, particularly suspicious inbound emails with malformed CC fields containing Base64-like payloads.
Patch, then assume compromise.
Upgrade to Zimbra Collaboration 8.8.15 Patch 46 or later, 9.0.0 Patch 41 or later, 10.0.9 or later, or 10.1.1 or later, according to the deployed release branch. Check affected servers for compromise, including webshells, using the NCSC detection tool where applicable. Patching fixes the vulnerability but does not remove webshells installed before remediation; identified malicious artifacts require separate cleanup.
3 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.