CVE-2022-37042
Description
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Summary dbcve.org
Zimbra Collaboration Suite 8.8.15 and 9.0 expose an mboximport endpoint that accepts ZIP archives and extracts their contents without requiring an authtoken. Because extraction lacks proper path validation, an unauthenticated remote attacker can perform directory traversal to write arbitrary files on the server, ultimately achieving remote code execution. This is a regression/incomplete fix for the earlier CVE-2022-27925 patch.
Mitigation
Apply the official Zimbra patch that completes the fix for CVE-2022-27925 (upgrade to a ZCS version containing the corrected mboximport path-handling and authentication enforcement), restrict network access to the mboximport service, and verify that authtoken validation is enforced prior to any ZIP extraction operation.