CVE-2022-41032

What it actually does

The flaw permits a local authenticated user to elevate privileges to full system control by abusing NuGet client operations during package handling or build processes.

Why it matters to the business

Compromised build systems or servers could allow attackers to modify software artifacts, inject malicious code into releases, or gain persistent access, increasing risk of supply-chain compromise across dependent projects.

How an attack unfolds

An attacker with local access prepares malicious input that exploits the NuGet client, triggers the vulnerability during normal operations such as package restore or build, and achieves elevated privileges without user interaction.

How to fix it

Upgrade zimbra/zm-build to commit ac6081fa002b1511e926aba37740d2b6c20f3f43 or later; rebuild and redeploy any affected images or packages that incorporate the vulnerable code.

How to confirm the fix worked

Confirm the repository is at or beyond commit ac6081fa002b1511e926aba37740d2b6c20f3f43; test NuGet client operations under low-privileged accounts to verify no privilege escalation occurs.

Typical attack path

1. Obtain local low-privileged access on a system running the vulnerable build tooling
2. Place or reference malicious NuGet package content
3. Invoke the NuGet client through normal build or package operations
4. Trigger privilege escalation to obtain higher rights

How to detect it

Review build and package manager logs for anomalous NuGet invocations, unexpected privilege changes, or processes spawned with higher rights than the invoking user; correlate with git history for pre-fix commits.

What your security team should do

• Apply the fixed commit immediately due to high local impact
• Audit all build pipelines that invoke NuGet client for exposure
• Restrict local access to build hosts until patched
• Monitor for unexpected privilege changes during builds