Zimbra Amavis cpio Path Traversal

aka Zimbra cpio RCE

Product: Synacor (Zimbra) Zimbra Collaboration Suite
CVE: CVE-2022-41352
Disclosed: 2022-09-26
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Zimbra Collaboration 8.8.15 and 9.0 on systems where Amavis uses cpio to unpack archives (no pax installed, e.g. RHEL/CentOS without pax).
Fixed: Zimbra 8.8.15 Patch 34 and 9.0.0 Patch 27 (switch to pax); workaround: install pax.

Summary

An attacker emails a crafted .cpio/.tar archive to any user on a Zimbra server. When Amavis unpacks it with cpio to scan it, path traversal drops a JSP webshell into Zimbra's public web root, so no authentication or user interaction is needed.

Root cause

Amavis falls back to the cpio utility to extract attachments when pax is missing. cpio (CVE-2015-1197) follows symlinks and does not prevent writes outside the extraction directory, so an archive containing a symlink to /opt/zimbra/jetty/webapps/zimbra/public plus a JSP file writes the webshell there.

Impact

Unauthenticated RCE as the zimbra user by sending an email, exploited in the wild as a zero-day.

Public PoC

# module builds a .tar: a symlink to TARGET_PATH plus <symlink>/public/<rand>.jsp
# default TARGET_PATH => '/opt/zimbra/jetty_base/webapps/zimbra/'
t.add_symlink(symlink_filename, datastore['TARGET_PATH'], 0o755)
t.add_file(File.join(symlink_filename, target_filename), 0o644) do |f|
  f.write(payload)
end
...
file_create(tar)
print_good('File created! Email the file above to any user on the target Zimbra server')
# with TRIGGER_PAYLOAD set, it then polls the JSP URL until Amavis/cpio drops it

Source: Rapid7 - Metasploit zimbra_cpio_cve_2022_41352

Detection

Check whether pax is installed (which pax); look for unexpected .jsp files under /opt/zimbra/jetty/webapps/zimbra/public/ and Amavis logs showing cpio extraction of archives.

Mitigation

Install pax and restart Zimbra, then apply the Zimbra patches; hunt for existing webshells.