New Zimbra Email Vulnerability Could Let Attackers Steal Your Login Credentials

A new superior-severity vulnerability has been disclosed in the Zimbra email suite that, if effectively exploited, permits an unauthenticated attacker to steal cleartext passwords of customers sans any user interaction.

“With the consequent entry to the victims’ mailboxes, attackers can most likely escalate their entry to focused organizations and achieve entry to many inner expert services and steal extremely delicate info,” SonarSource explained in a report shared with The Hacker Information.

Tracked as CVE-2022-27924 (CVSS score: 7.5), the issue has been characterised as a case of “Memcached poisoning with unauthenticated ask for,” top to a circumstance in which an adversary can inject malicious commands and siphon delicate facts.

This is made feasible by poisoning the IMAP route cache entries in the Memcached server that is used to glimpse up Zimbra users and forward their HTTP requests to proper backend companies.

Presented that Memcached parses incoming requests line-by-line, the vulnerability permits an attacker to mail a specifically crafted lookup ask for to the server made up of CRLF people, creating the server to execute unintended instructions.

The flaw exists for the reason that “newline people (rn) are not escaped in untrusted person enter,” the scientists explained. “This code flaw eventually enables attackers to steal cleartext credentials from end users of focused Zimbra cases.”

Armed with this capability, the attacker can subsequently corrupt the cache to overwrite an entry this kind of that it forwards all IMAP traffic to an attacker-controlled server, including the qualified user’s credentials in cleartext.

That stated, the attack presupposes the adversary now is in possession of the victims’ email addresses so as to be ready to poison the cache entries and that they use an IMAP customer to retrieve email messages from a mail server.

“Normally, an organization takes advantage of a sample for email addresses for their members, such as e.g., [email protected],” the researchers stated. “A record of email addresses could be obtained from OSINT resources these types of as LinkedIn.”

A risk actor, even so, can get around these limitations by exploiting a approach called response smuggling, which entails “smuggling” unauthorized HTTP responses that abuse the CRLF injection flaw to forward IMAP visitors to a rogue server, therefore stealing qualifications from buyers without having prior understanding of their email addresses.

“The thought is that by repeatedly injecting more responses than there are function goods into the shared response streams of Memcached, we can drive random Memcached lookups to use injected responses rather of the right response,” the researchers spelled out. “This will work mainly because Zimbra did not validate the key of the Memcached response when consuming it.”

Next liable disclosure on March 11, 2022, patches to absolutely plug the security gap have been delivered by Zimbra on May perhaps 10, 2022, in variations 8.8.15 P31.1 and 9.. P24.1.

The conclusions arrive months right after cybersecurity organization Volexity disclosed an espionage marketing campaign dubbed EmailThief that weaponized a zero-working day vulnerability in the email system to target European federal government and media entities in the wild.

Identified this posting interesting? Stick to THN on Fb, Twitter  and LinkedIn to read through much more unique written content we write-up.

Some components of this posting are sourced from:
thehackernews.com