Zimbra Collaboration Suite外部实体注入漏洞

详细信息

漏洞类型

代码问题

漏洞描述

Zimbra Collaboration Suite（ZCS）是美国Zimbra公司的一款开源协同办公套件。该产品包括WebMail、日历、通信录等。Synacor Zimbra协作套件8.7.x-8.7.11p10的mailboxd组件存在XML外部实体注入（XXE）漏洞，如Autodiscover/Autodiscover.xml所示。

修复建议

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://blog.zimbra.com/2019/03/new-zimbra-8-7-11-patch-10/

参考链接

• https://bugzilla.zimbra.com/show_bug.cgi?id=109129

  OSV · x_refsource_MISC

• https://www.exploit-db.com/exploits/46693/

  OSV · exploit · x_refsource_EXPLOIT-DB

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

  OSV · x_refsource_MISC

• http://www.rapid7.com/db/modules/exploit/linux/

  NVD

• https://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html

  NVD · Third Party Advisory · Exploit · VDB Entry

• https://www.exploit-db.com/exploits/46693

  NVD · Third Party Advisory · Exploit · VDB Entry

• https://nvd.nist.gov/vuln/detail/CVE-2019-9670
• http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce

  OSV · x_refsource_MISC

• http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html

  OSV · x_refsource_MISC

• https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/

  OSV · x_refsource_MISC

• https://osv.dev/vulnerability/CVE-2019-9670

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9670

  NVD · US Government Resource