CVE-2022-24682 PoC — Zimbra Collaboration Suite 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24682.yaml

Associated Vulnerability

Title:Zimbra Collaboration Suite 跨站脚本漏洞 (CVE-2022-24682)
Description:Synacor Zimbra Collaboration Suite（ZCS）是美国Synacor公司的一款开源协同办公套件。该产品包括WebMail、日历、通信录等。 Zimbra Collaboration Suite 8.8存在安全漏洞，该漏洞源于攻击者可利用该漏洞可以将包含可执行JavaScript的HTML放在元素属性中。此标记变为未转义的，从而导致将任意标记注入到文档中。

Description

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

File Snapshot


 id: CVE-2022-24682

info:
  name: Zimbra Collaboration Suite < 8.8.15 - Improper Encoding
  author: 

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!