By asahifile 
Attack of the Emails: Critical Zimbra Vulnerability Exploited by Attackers
Attackers are taking advantage of a severe vulnerability in the Zimbra email and collaboration server, which is primarily used by medium to large organizations, according to recent security warnings. The vulnerability, identified as CVE-2024-45519, allows attackers to execute arbitrary commands remotely, potentially leading to the installation of a backdoor on compromised systems.
This flaw arises when administrators modify default settings to enable the postjournal service. By sending specially crafted emails to targeted addresses on the server, attackers can exploit this vulnerability. Zimbra has already issued a patch for this issue; thus, all users are advised to implement it immediately or deactivate the postjournal service if it’s not needed.
Current Status of Exploitation
Security researcher Ivan Kwiatkowski highlighted a surge in active exploitation of this vulnerability, describing the situation as “mass exploitation.” Malicious emails originating from a specific IP address attempted to run commands using the curl tool. Additional analyses conducted by Proofpoint confirmed the ongoing threat but indicated that the overall risk appears contained due to the necessity of a specific setting alteration on vulnerable servers.
Notably, evidence suggests that even though the exploitation method is straightforward, reliability in successfully executing attacks is variable. Security expert Ron Bowes pointed out that the payload associated with these attacks is relatively benign; it merely downloads a file but does not execute it.
Insights from Security Researchers
Further investigation has illustrated that attempts to exploit this vulnerability are indiscriminate. While multiple email addresses were used in attack attempts, researchers noted that successful exploitation outcomes thus far have not aligned with widespread malware concerns like ransomware attacks.
Proofpoint’s Greg Lesnewich reiterated overall caution but also echoed the belief that large-scale infections seem unlikely. Notably, the exploit attempts lack sophistication, as they stem from a centralized infrastructure that suggests limited resources on the attacker’s end.
Detailed Exploitation Mechanism
Recent reports indicated the use of malformed email addresses in the CC field to trigger the installation of a webshell-based backdoor on susceptible systems. This technique, involving base64 encoded command strings, enables attackers to create a webshell file at a predetermined server path. Once established, this backdoor can parse commands and execute them based on incoming connections.
Proofpoint first detected these exploitation attempts on September 28, the day before Project Discovery successfully reverse-engineered the Zimbra patch and created a proof-of-concept exploit.
Conclusion: Immediate Steps for Zimbra Users
Users of Zimbra are urged to apply the security patch without delay and ensure that the postjournal service is disabled unless explicitly required. While the current exploitation landscape appears to lack immediacy and severity, vigilance in monitoring incoming email communications and server logs is crucial in thwarting potential future attacks.
Author Note: Dan Goodin, Senior Security Editor at Ars Technica, specializes in coverage of cybersecurity issues, including malware, hacking, and privacy breaches. Keep abreast of developments by following him on various platforms.