SERVER-WEBAPP Zimbra remote code execution attempt
This alert is triggered when detecting an attempt to exploit a directory traversal vulnerability in Zimbra Collaboration Suite, to potentially extract sensitive configuration details. Zimbra Collaboration Suite is an open-source email, calendaring, and collaboration software. This rule is particularly looking for requests aimed at retrieving the localconfig.xml file by exploiting a path traversal vulnerability. This XML file can potentially contain sensitive configuration details.
ID Number
29027
Signature
alert tcp $EXTERNAL_NET any -> $HOME_NET 7071 (msg:"SERVER-WEBAPP Zimbra remote code execution attempt"; flow:to_server,established; content:"/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml"; fast_pattern:only; metadata:policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.exploit-db.com/exploits/30085/; classtype:attempted-admin; sid:29027; rev:6;)
MITRE ATT&CK Technique
-
Severity
High
Recommendations/Investigative actions
It is recommended to ensure that the Zimbra Collaboration Suite is up-to-date with the latest security patches to mitigate known vulnerabilities. Inspect logs to determine if the attempted exploitation was successful. Look for signs of data breaches or unauthorized access. If possible, block communication Attempts from external networks, or enable access from specific external devices only.