"While the postjournal feature may be optional or not enabled on most systems, it is still necessary to apply the provided patch to prevent potential exploitation," Ashish Kataria, a security architect engineer at Synacor, noted in a comment on September 19, 2024. The attacks seek to exploit CVE-2024-45519, a severe security flaw in its postjournal service that could enable unauthenticated attackers to execute arbitrary commands on affected Zimbra installations. Cybersecurity researchers are warning about active exploitation attempts targeting a newly disclosed security flaw in Synacor's Zimbra Collaboration. "The emails spoofing Gmail were sent to bogus addresses in the CC fields in an attempt for Zimbra servers to parse and execute them as commands," Proofpoint said in a series of posts on X. The installed web shell subsequently listens for inbound connection with a pre-determined JSESSIONID Cookie field, and if present, it proceeds to parse the JACTION cookie for Base64 commands. Struggling to convey cybersecurity risks to your board? Our eBook offers actionable insights for CISOs, helping you present accurate, meaningful reports with confidence. Enterprise security firm Proofpoint said it began observing the activity starting September 28, 2024. The critical issue was addressed by Zimbra in versions 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, and 10.1.1 released on September 4, 2024. In light of active exploitation attempts, users are strongly recommended to apply the latest patches for optimum protection against potential threats.
This Cyber News was published on thehackernews.com. Publication date: Wed, 02 Oct 2024 06:43:07 +0000