CVE-2019-9670

What is Zimbra Collaboration Suite?

Zimbra Collaboration Suite is a widely deployed on-premises email and collaboration platform used by enterprises, universities, and government agencies as an alternative to hosted webmail services.

Overview

CVE-2019-9670 is a critical (CVSS 9.8) XML External Entity (XXE) injection vulnerability (CWE-611) in Zimbra's mailboxd component, allowing an unauthenticated remote attacker to read arbitrary files from the server and, in many documented cases, escalate to full remote code execution.

Technical Details

The mailboxd Java service parses XML input without disabling external entity resolution, allowing an attacker to define a malicious external entity in a crafted XML payload. When the parser resolves that entity, it can read arbitrary local files (such as Zimbra's localconfig.xml, which contains database and LDAP credentials) or make outbound network requests — and in Zimbra's specific case, obtaining those credentials has repeatedly been used as a stepping stone to full administrative and remote code execution compromise of the mail server.

Discovery

Publicly disclosed with proof-of-concept exploit code shortly after the underlying issue was identified in mid-2019, prompting rapid patching from Synacor/Zimbra.

Exploitation Context

This is one of the more heavily and persistently exploited Zimbra vulnerabilities: security researchers and government advisories have documented scanning and compromise of unpatched, internet-facing Zimbra servers using this XXE, in some cases attributed to espionage-motivated actors targeting webmail for intelligence collection, and in others used by financially motivated groups to deploy web shells and cryptominers. CISA added it to KEV in January 2022. It has also been documented as being chained with Zimbra's SSRF vulnerability (CVE-2019-9621) in real-world attack sequences.

Remediation

1. Update Zimbra Collaboration Suite to the latest patched version immediately — this is one of the most consequential Zimbra vulnerabilities still seen exploited in the wild.
2. Rotate all credentials stored in Zimbra's local configuration (database, LDAP, admin) if compromise is suspected, since XXE-based file reads commonly target these files.
3. Restrict administrative and mailboxd endpoints from unauthenticated internet access wherever feasible.
4. Search for indicators of compromise such as unexpected web shells, JSP files, or scheduled tasks on Zimbra servers.
5. Monitor for unusual outbound connections or file-read attempts consistent with XXE exploitation in Zimbra logs.