CVE-2022-37042

What is Zimbra Collaboration Suite?

Zimbra Collaboration Suite (ZCS) is an enterprise email, calendar, and collaboration platform used by government agencies, healthcare organisations, and enterprises globally. Its mboximport feature (the MailboxImportServlet) allows authenticated administrators to upload mailbox archive files (ZIP format) for import. CVE-2022-37042 removed the authentication requirement from this endpoint — transforming a privileged management function into an unauthenticated file upload vector accessible to any internet attacker.

Overview

CVE-2022-37042 is an authentication bypass in the MailboxImportServlet (mboximport) of Zimbra Collaboration Suite 8.8.15 and 9.0. By sending a request without a valid authentication token (authtoken), an unauthenticated attacker can bypass the authentication check and upload arbitrary files to the Zimbra server. Combined with path traversal, this achieves remote code execution without any credentials or user interaction.

CVE-2022-37042 is an incomplete fix for CVE-2022-27925, which had the same file upload vulnerability but required authentication. CVE-2022-37042 is the bypass that makes the attack fully unauthenticated.

Affected Versions

Technical Details

The MailboxImportServlet was designed to receive ZIP archives containing mailbox data from authenticated administrators. CVE-2022-27925 established that the servlet allowed authenticated users to upload arbitrary files and achieve path traversal — writing files outside the intended mailbox import directory. The fix for CVE-2022-27925 was supposed to add authentication enforcement. CVE-2022-37042 demonstrates that the fix was incomplete: by omitting the authtoken from the request, the servlet still processes the upload and executes the file operation, granting the same directory traversal capability without any credentials.

Combined with CVE-2022-27925's traversal capability, the two-CVE chain allows an unauthenticated attacker to:

1. Send a POST request to the mboximport endpoint without an authtoken
2. Include a ZIP archive with a path-traversing filename pointing to the Zimbra web root
3. Extract a JSP webshell to /opt/zimbra/jetty/webapps/zimbra/ or a similar web-accessible path
4. Access the webshell over HTTP and execute arbitrary commands on the server as the Zimbra service user

Attack characteristics:

• Authentication required: No (authentication bypass)
• User interaction: None
• Attack complexity: Low
• Network-accessible: Yes — mboximport is available via standard HTTPS

Exploitation Context

On August 10, 2022, Volexity reported mass exploitation of the CVE-2022-27925 + CVE-2022-37042 chain against over 1,000 Zimbra Collaboration Suite instances globally. The campaign was widespread and opportunistic, deploying webshells that provided persistent SYSTEM-level access to compromised mail servers.

CISA and the MS-ISAC jointly documented the Zimbra exploitation wave in advisory AA22-228A, noting that multiple threat actor groups — including both nation-state-affiliated actors and ransomware operators — were actively exploiting vulnerabilities across the Zimbra CVE cluster. CISA flagged CVE-2022-37042 with ransomware use, consistent with the observed post-exploitation pattern of webshell deployment as a foothold for ransomware staging.

Remediation

1. Apply Zimbra security updates per the Zimbra security advisory and Zimbra Security Center. The fix adds proper authentication enforcement to the mboximport servlet.
2. Restrict mboximport access — if your operational requirements allow, restrict access to the /service/home/ mboximport endpoint to trusted administrator IP ranges via WAF or network ACL.
3. Hunt for webshell artifacts — search the Zimbra web root (/opt/zimbra/jetty/webapps/zimbra/ and subdirectories) for JSP files with modification dates after the estimated exploitation window. Unexpected JSP files in the web root are a strong indicator of compromise.
4. Review authentication logs for the mboximport endpoint for requests without a valid authtoken — these are indicators of exploitation attempts.
5. If compromise is suspected: treat the Zimbra server as fully compromised. Collect forensic artifacts, rebuild from clean patched media, and rotate all credentials stored in or accessible from the server.