CVE-2022-41352

What it actually does

This vulnerability is a path traversal and arbitrary file upload flaw in Zimbra Collaboration Suite archive handling. A remote attacker can send a specially crafted email containing a malicious archive attachment that is processed by the mail security/antivirus pipeline. During archive extraction, traversal sequences or crafted archive metadata can cause files to be written outside the intended temporary extraction directory. In observed exploitation, attackers used this behavior to place server-side web shell files under Zimbra web-accessible directories, enabling remote command execution with the privileges of the Zimbra service account.

Why it matters to the business

Successful exploitation can give an attacker control over a Zimbra mail server, allowing theft of email data, credential harvesting, mailbox access, lateral movement, persistence, and service disruption. Because Zimbra commonly stores sensitive corporate communications and credentials, compromise can have significant legal, operational, and reputational consequences. This issue is listed in CISA KEV, has a very high EPSS score, and is known to be actively exploited in the wild; organizations that missed the CISA remediation deadline of 2022-11-10 should treat exposed or unpatched systems as high priority for both patching and compromise assessment.

How an attack unfolds

An attacker does not need interactive access to the target server. They craft an email with an archive attachment designed to abuse unsafe extraction behavior in the mail scanning workflow. When the Zimbra server receives the message, the antivirus or content-scanning component extracts the attachment for inspection. The malicious archive causes files to be written outside the expected scan directory, typically into a web-accessible Zimbra application path. The attacker then sends HTTP requests to the newly written web shell or payload and executes commands on the server. From there, they may dump mail data, collect credentials, deploy persistence, add additional web shells, proxy traffic, or move laterally into adjacent infrastructure.

How to fix it

Upgrade Zimbra Collaboration Suite to a vendor-supported fixed release or the latest available security patch level. Where vendor guidance applies, install the `pax` package so the archive extraction workflow does not rely on vulnerable `cpio` behavior, then restart Zimbra services. Common mitigation commands include installing `pax` through the operating system package manager, such as `apt install pax` on Debian/Ubuntu-based systems or `yum install pax` / `dnf install pax` on Red Hat-derived systems, followed by a Zimbra service restart. Remove any unsupported or end-of-life Zimbra versions from production. Because this vulnerability has been actively exploited, remediation should include a compromise assessment, not patching alone. If compromise is suspected, isolate the server, preserve evidence, rotate credentials, review mail access, and rebuild from trusted media where integrity cannot be established.

How to confirm the fix worked

Confirm the installed Zimbra version and patch level are at or above the vendor-fixed release. Verify that `pax` is installed and available in the system path used by the Zimbra services. Confirm Zimbra services were restarted after mitigation. Test that inbound mail processing continues to function normally and that archive attachments are scanned without using vulnerable extraction behavior. Review `/opt/zimbra/jetty/webapps/`, `/opt/zimbra/jetty/webapps/zimbra/`, `/opt/zimbra/jetty/webapps/zimbra/public/`, and related web application directories for unexpected JSP, WAR, shell script, or recently modified files. Validate that no unauthorized web-accessible files remain and that HTTP requests to suspicious uploaded paths return 404 or are otherwise blocked.

Typical attack path

1. Identify an internet-facing Zimbra Collaboration Suite server.
2. Send a crafted email containing a malicious archive attachment to an address handled by the server.
3. Wait for the mail scanning component to process and extract the attachment.
4. Abuse path traversal during extraction to write a malicious file into a web-accessible Zimbra directory.
5. Access the uploaded web shell or payload over HTTP or HTTPS.
6. Execute commands as the Zimbra service user.
7. Collect mailbox data, credentials, configuration files, tokens, or deploy additional persistence.

How to detect it

Review mail processing logs, antivirus/amavis logs, mailbox logs, web access logs, and operating system logs for suspicious sequences: inbound email with archive attachments, extraction or scanner errors, creation of unexpected files under Zimbra web directories, and subsequent HTTP requests to those files. Focus on recently created or modified `.jsp`, `.jspx`, `.war`, `.class`, `.sh`, or hidden files in Zimbra web roots. Investigate HTTP requests that include command-execution parameters, unusual POST requests to JSP files, requests from rare external IP addresses, and web requests shortly after suspicious inbound messages. Check process execution history for Zimbra or Jetty spawning shell interpreters such as `sh`, `bash`, `curl`, `wget`, `python`, `perl`, or other tools not normally launched by the mail application. Review authentication and mailbox audit logs for unexpected administrative activity, mailbox exports, suspicious delegated access, or access from unfamiliar IP addresses after the likely exploitation window. Because this issue has been widely exploited, absence of a known filename is not sufficient; hunt by file creation time, webroot anomalies, process ancestry, and anomalous HTTP access patterns.

• /opt/zimbra/jetty/webapps/zimbra/public/
• /opt/zimbra/jetty/webapps/zimbra/
• /opt/zimbra/jetty/webapps/
• /opt/zimbra/log/mailbox.log
• /opt/zimbra/log/audit.log
• /var/log/zimbra.log
• /var/log/mail.log
• /var/log/maillog
• /opt/zimbra/log/nginx.access.log
• /opt/zimbra/log/nginx.log
• /opt/zimbra/log/access_log*
• /opt/zimbra/log/amavisd.log
• GET /zimbra/public/
• POST /zimbra/public/
• .jsp
• jspx
• Runtime.getRuntime().exec
• ProcessBuilder
• cmd=
• exec=
• javax.servlet.jsp
• /bin/bash
• /bin/sh
• wget
• curl
• python -c
• perl -e
• nc -e
• bash -i
• cpio
• pax

What your security team should do

• Immediately identify all internet-facing and internal Zimbra Collaboration Suite servers.
• Patch or upgrade affected Zimbra systems and install `pax` where recommended by vendor guidance.
• Prioritize this issue as urgent because it is in CISA KEV, has very high exploitation probability, and is actively exploited in the wild.
• Perform forensic review for web shells and suspicious files before assuming patching has resolved the incident risk.
• Search web, mailbox, audit, and system logs for evidence of malicious archive processing followed by access to newly created JSP or web shell paths.
• Rotate Zimbra administrator credentials, mailbox credentials, API tokens, and any credentials stored on or accessible from the server if compromise is suspected.
• Restrict direct internet access to Zimbra administrative and web interfaces where business requirements allow.
• Add file integrity monitoring for Zimbra web application directories and alert on new or modified executable web content.
• Harden mail attachment scanning workflows and monitor for archive extraction errors, traversal strings, and suspicious attachment names.
• If exploitation is confirmed, isolate the host, preserve logs and disk artifacts, investigate mailbox access, and consider rebuilding the server from a known-good source.