An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload.
PoC代码[已公开]
id: CVE-2024-27443
info:
name: Zimbra Collaboration - Cross-Site Scripting (XSS)
author: rxerium
severity: medium
description: |
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload.
reference:
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes
- https://nvd.nist.gov/vuln/detail/CVE-2024-27443
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2024-27443
cwe-id: CWE-79
epss-score: 0.39206
epss-percentile: 0.97108
cpe: cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: zimbra
product: collaboration
shodan-query:
- http.favicon.hash:"1624375939"
- http.html:"zimbra collaboration suite web client"
- http.favicon.hash:"475145467"
fofa-query:
- icon_hash="1624375939"
- app="zimbra-邮件系统"
- body="zimbra collaboration suite web client"
- icon_hash="475145467"
tags: cve,cve2022,zimbra,kev,passive,xss,vkev
http:
- method: GET
path:
- "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "Zimbra Collaboration"
- type: word
part: content_type
words:
- "application/x-javascript"
- type: dsl
dsl:
- compare_versions(version, '9.0.0')
- compare_versions(version, '>= 10.0.0', '< 10.0.7')
condition: or
extractors:
- type: regex
part: body
name: version
group: 1
regex:
- CLIENT_VERSION\",\s+{type:ZmSetting\.T_CONFIG, defaultValue:"([0-9.]+)_([A-Z_0-9]+)"\}
# digest: 4a0a0047304502205f174a2a57ee2933b74b287d57e99ce16db356de0fba96ae556708ba60e43193022100e577a38e8e75a0e706a3712702da91ede12c8cd4ba78dafe432602950fece92e:922c64590222798bb761d5b6d8e72950