Proofpoint’s threat researchers say that the attacks started on September 28 – several weeks after Zimbra developers released patches for CVE-2024-45519 and other flaws, and a day after ProjectDiscovery’s analysts published a detailed technical write-up about the vulnerability and a PoC exploit to demonstrate the potential for local exploitation. “The vulnerability stems from unsanitized user input being passed to popen [function] in the unpatched version [of the postjournal binary], enabling attackers to inject arbitrary commands,” ProjectDiscovery’s analysts explained. “While the postjournal feature may be optional or not enabled on most systems, it is still necessary to apply the provided patch to prevent potential exploitation,” a Synacor security architect and engineer confirmed when patches for several Zimbra versions were provided in early September. “While the patched version introduces input sanitization and replaces popen with execvp, mitigating direct command injection, it’s crucial for administrators to apply the latest patches promptly. Attackers are actively exploiting CVE-2024-45519, a critical Zimbra vulnerability that allows them to execute arbitrary commands on vulnerable installations. CVE-2024-45519 is an OS command injection vulnerability in the solution’s postjournal service (and binary), which is used for recording email communications for compliance and/or archiving.
This Cyber News was published on www.helpnetsecurity.com. Publication date: Wed, 02 Oct 2024 11:43:04 +0000