Loading vulnerability…
CVE-2024-45519 is an unauthenticated remote command-execution vulnerability in the Zimbra Collaboration postjournal service, which supports email journaling and archiving. Insufficient validation of attacker-controlled email-header data can allow a specially crafted, spoofed email—reported to use a base64-encoded payload in the CC field—to reach command execution on the Zimbra server. It affects Zimbra Collaboration releases before 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, and 10.1.1.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a Python exploit script for CVE-2024-45519, a remote code execution vulnerability in Zimbra Collaboration Suite. The exploit works by sending a specially crafted SMTP message to the target's mail server, injecting a command into the recipient address. The command is constructed to trigger the target to execute either a curl or wget command, sending the output of 'id' to an attacker-controlled Interactsh server. The script uses the Interactsh service to generate a unique payload URL and to monitor for outbound HTTP requests from the target, confirming successful code execution. The repository consists of a README and a single exploit script. The script requires the attacker to provide the target's IP, port, Interactsh server URL, token, and an output file for results. The exploit is operational and provides confirmation of code execution via OOB interaction, but does not provide a full shell or advanced payload customization.
This repository provides a working exploit for CVE-2024-45519, a critical unauthenticated command execution vulnerability in Zimbra Collaboration Suite (ZCS) affecting several major versions (Joule 8.8.15, Kepler 9.0.0, Daffodil 10.0.x < 10.0.9, and 10.1.0) on Linux. The exploit targets the 'postjournal' service via SMTP, injecting a base64-encoded bash reverse shell payload into the RCPT TO field of an SMTP transaction. The exploit is implemented in Python (exploit.py) and uses libraries such as pwntools, pwncat, and Faker. The script sets up a listener on the attacker's machine and, upon successful exploitation, provides a reverse shell from the target Zimbra server. The README.md offers detailed lab setup instructions, including how to install and configure a vulnerable Zimbra instance, and how to use the exploit. The requirements.txt lists necessary Python dependencies. The main entry point is exploit.py, which is a standalone exploit script and not part of a larger framework. The exploit is operational, providing a real reverse shell payload, and is suitable for use in penetration testing or red teaming scenarios against vulnerable Zimbra installations.
This repository contains a Python proof-of-concept exploit for CVE-2024-45519, targeting a vulnerability in SMTP servers. The main script, 'CVE-2024-45519-Poc.py', first checks if the target SMTP port (default 25) is open. It then attempts to verify the vulnerability by sending a crafted RCPT TO payload that triggers an out-of-band request (OAST). If the server is found vulnerable, the script sends another payload to execute a bash reverse shell, connecting back to the attacker's machine (whose IP and port must be specified). The exploit requires the attacker to have a listener (e.g., netcat) running to catch the shell. The repository also includes a README.md with usage instructions and legal disclaimers. No framework is used; the exploit is standalone and operational, with a hardcoded but modifiable payload.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Zimbra (CVE-2024-45519) that allows command execution due to insufficient guarding in the code. The analysis focuses on understanding the patch and recreating the vulnerable condition for exploitation.
A critical Zimbra vulnerability listed among specific vulnerabilities and affected products associated with the group's exploitation activity.
A high-severity Zimbra Collaboration vulnerability that permits remote arbitrary code execution on a vulnerable Zimbra server through a specially crafted email. Attackers can use it to deploy webshells and retain remote access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.