Critical Remote File Inclusion Vulnerability in Zimbra Collaboration Suite

What changed

A Local File Inclusion (LFI) vulnerability has been discovered in the Webmail Classic UI of the Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. This flaw arises from inadequate handling of user-supplied parameters within the RestFilter servlet.

An unauthenticated attacker can exploit this vulnerability by sending crafted requests to the /h/rest endpoint, potentially leading to the inclusion of arbitrary files from the WebRoot directory.

Who is affected

The vulnerability impacts users of the Zimbra Collaboration Suite, specifically those utilizing versions 10.0 and 10.1. Organizations relying on this software for email and collaboration services should take immediate notice.

The following groups are particularly at risk:

• Organizations using Zimbra Collaboration Suite (ZCS) for email and collaboration.
• IT departments managing ZCS installations in their infrastructure.
• Businesses that handle sensitive information through ZCS.

What to do

It is crucial for affected organizations to assess their current ZCS installations and apply necessary updates or patches as soon as they are made available by Synacor. Monitoring for unusual activity related to the /h/rest endpoint is also advised.

In addition, consider implementing the following measures:

• Review and restrict access to the ZCS installation to trusted networks only.
• Conduct a security audit of the current deployment to identify potential exposure.
• Stay informed about updates from Synacor regarding this vulnerability and follow their guidance.