Remote Command Execution Vulnerability in Zimbra Collaboration Suite

Advisory ID: ngCERT-2025-010008

Summary

A critical Remote Code Execution (RCE) vulnerability has been identified in Zimbra Collaboration Suite (ZCS), a widely used email and collaboration platform. This vulnerability, designated CVE-2024-45519, enables unauthenticated attackers to execute arbitrary commands on affected Zimbra installations. Exploiting this flaw can lead to system compromise, data theft, and malware infiltration. Administrators and users are strongly urged to implement necessary security measures to prevent exploitation.

CVE Details:

• CVE: CVE-2024-45519
• Probability: High
• Damage Potential: Critical
• Affected Platforms: Zimbra Collaboration Suite

Description

The vulnerability originates from Zimbra’s postjournal service, which processes incoming emails over SMTP. Threat actors exploit this flaw by sending specially crafted emails with commands embedded in the carbon copy (CC) field. The postjournal service, upon processing the email, executes the base64-encoded commands through the ‘sh’ shell, ultimately allowing attackers to drop and execute a webshell on the server.

Once installed, the webshell:

1. Listens for inbound connections containing a specific JSESSIONID cookie field.
2. Parses another cookie (JACTION) to extract base64-encoded commands for execution.
3. Supports downloading and executing files, granting full access to the compromised server.

Vulnerable Versions:

• ZCS 8.8.15 (Versions before Patch 46)
• ZCS 9 (Versions before Patch 41)
• ZCS 10 (Versions before 10.0.9)
• ZCS 10.1 (Versions before 10.1.1)

Consequences of Exploitation

Successful exploitation of CVE-2024-45519 can lead to severe security risks, including:

1. Full system compromise, allowing attackers to control the Zimbra server.
2. Data exfiltration, leading to unauthorized access to sensitive emails and files.
3. Ransomware deployment, potentially causing financial losses.
4. Denial of Service (DoS) attacks, disrupting email and collaboration services.

Solution and Mitigation

To protect against exploitation, administrators should implement the following measures:

1. Disable the postjournal service if it is not required.
2. Ensure proper configuration of mynetworks to restrict unauthorized access.
3. Apply the latest security patches provided by Zimbra

Conclusion

CVE-2024-45519 is a serious vulnerability affecting Zimbra Collaboration Suite, exposing organizations to system compromise, data breaches, and malware infections. Administrators must act promptly by applying patches, disabling unused services, and securing network configurations to mitigate the risk.

By staying updated on security advisories and taking proactive security measures, organizations can reduce their attack surface and protect their critical communication infrastructure.Remote Command Execution Vulnerability in Zimbra Collaboration Suite

References

For more details on the vulnerability and security patches, refer to the following sources:

• Zimbra Security Advisories
• Zimbra Blog: Security Patch Release
• BleepingComputer Report on Zimbra RCE Exploits
• Project Discovery: Zimbra Remote Code Execution Analysis