# MA-870.102022: MyCERT Advisory - Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite

**Date:** 02 Oct 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-870.102022  
**Advisory ID:** MA-870.102022

---

**1.0 Introduction**
Recently, there were reports regarding the active exploitation of multiple Common Vulnerabilities and Exposures (CVEs) against Zimbra Collaboration Suite (ZCS), an enterprise cloud-hosted collaboration software and email platform.
**2.0 Impact**
Cyber threat actors may be targeting unpatched ZCS instances in both government and private sector networks. CVEs currently being exploited against ZCS include:
**2.1 CVE-2022-27924**
CVE-2022-27924 enables an unauthenticated malicious actor to inject arbitrary Memcache commands into a targeted ZCS instance and cause an overwrite of arbitrary cached entries. The actor can then steal ZCS email account credentials in cleartext form without any user interaction. With valid email account credentials in an organization not enforcing multifactor authentication (MFA), a malicious actor can use spear phishing, social engineering, and business email compromise (BEC) attacks against the compromised organization.
**2.2 CVE-2022-27925 and CVE-2022-37042**
CVE-2022-27925 allows an authenticated user the ability to upload arbitrary files to the system thereby leading to directory traversal.
CVE 2022 37042 could allow an unauthenticated malicious actor access to a vulnerable ZCS instance.
**2.3 CVE-2022-30333**
A malicious actor can exploit CVE-2022-30333 against a ZCS server by sending an email with a malicious RAR file. Upon email receipt, the ZCS server would automatically extract the RAR file to check for spam or malware. Any ZCS instance with unrar installed is vulnerable to CVE-2022-30333.
**2.4 CVE-2022-24682**
CVE-2022-24682 contains cross-site scripting (XSS) vulnerability allowing malicious actors to steal session cookie files.
**3.0 Affected Products**
• Zimbra Collaboration Suite (ZCS)
**4.0 Recommendations**
Users and administrators are recommended to take the mitigation steps below as soon as possible:
• Patch all systems and prioritize patching known exploited vulnerabilities.
• Organizations that did not immediately update their ZCS instances upon patch release are advised to deploy detection signatures and hunt for malicious activities and indicators of compromise (IOCs).
• If ZCS was compromised, eradicate the malicious activities immediately and rectify the compromised server.
Generally, MyCERT advises users to be updated with the latest security announcements by the vendor, and follow best practices and security policies to determine which updates should be applied.
For further inquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
• <https://www.cisa.gov/uscert/ncas/current-activity/2022/09/27/cisa-updates-advisory-threat-actors-exploiting-multiple-cves>
• <https://www.cisa.gov/uscert/ncas/alerts/aa22-228a>