2022 - You've got mail! And I'm root on your Zimbra server by Thomas Chauchefoin
Security researchers examine technical aspects of 2022 - You've got mail! And I'm root on your Zimbra server by Thomas Chauchefoin.
Summary
Why Zimbra Is a High-Value Target
Thomas Chauchefoin of Sonar describes Zimbra as a widely deployed all-in-one mail platform used by universities, governments, and enterprises. Exposed SMTP and web interfaces make compromise especially damaging because mail servers hold credentials, attachments, and password-reset links.
Recent Attack Landscape
The talk references Volexity and other reports of XSS, webshells, and authentication bypasses during mailbox imports that enabled unauthenticated remote code execution on internet-facing instances, sometimes attributed to state actors seeking data rather than financial gain.
Four Bugs in Three Months
Research across user-facing services, internal components, and inbound email processing uncovered four vulnerabilities: stored XSS via message display, authenticated SSRF chained to XSS, newline injection breaking caching to leak passwords, and archive-extractor abuse yielding RCE on any instance.
Sanitize-Send-Modify Pattern
Rather than bypassing Zimbra's Java HTML sanitizer directly, the team exploited post-sanitization transformations that reintroduced dangerous markup. Chauchefoin credits prior work by Simon Tse and promises live demos of the findings.
Related talks
Kaspersky·3 min
Presenters detail vulnerability discovery and exploitation in Security for Mail Server. Protection for every aspect of your corporate email.
NahamSec·21 min
#NahamCon2023: Hacking Root EPP Servers To Take Control of Zones | @infosec_au.
Videos·53 min
Engineers explore architecture and security mechanisms for Medieval Castles and Modern Servers by Christian Folini (@ChrFolini).