An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
PoC代码[已公开]
id: CVE-2022-24682
info:
name: Zimbra Collaboration Suite < 8.8.15 - Improper Encoding
author: rxerium
severity: medium
description: |
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2022-24682
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2022-24682
epss-score: 0.87687
epss-percentile: 0.99428
cwe-id: CWE-116
metadata:
max-request: 1
vendor: zimbra
product: collaboration
shodan-query:
- http.favicon.hash:"1624375939"
- http.html:"Zimbra Collaboration Suite Web Client"
fofa-query: icon_hash="1624375939"
tags: cve,cve2022,zimbra,collaboration,xss,kev,passive,vkev,vuln
http:
- method: GET
path:
- "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "Zimbra Collaboration Suite Web Client"
- type: word
part: content_type
words:
- "application/x-javascript"
- type: dsl
dsl:
- "compare_versions(detected_version, '< 8.8.15')"
- "compare_versions(detected_version, '> 8.7.15')"
condition: and
extractors:
- type: regex
part: body
name: detected_version
group: 1
regex:
- CLIENT_VERSION\",\s+{type:ZmSetting\.T_CONFIG, defaultValue:"([0-9.]+)_([A-Z_0-9]+)"\}
# digest: 490a00463044022033658230e5362ca26893d0abae1180bd5020de71ff50b5169179109926570f8b0220354040bfd9e2b67a3f4de681bb4959038f0447be8639e60054d2b6c59dedc531:922c64590222798bb761d5b6d8e72950