CVE-2022-41352 PoC — Zimbra Collaboration Suite 路径遍历漏洞

Source

https://github.com/rxerium/CVE-2022-41352

Associated Vulnerability

Title:Zimbra Collaboration Suite 路径遍历漏洞 (CVE-2022-41352)
Description:Zimbra Collaboration Suite（ZCS）是美国Zimbra的一款开源协同办公套件。该产品包括WebMail、日历、通信录等。 Zimbra Collaboration Suite (ZCS) 8.8.15版本和9.0版本存在路径遍历漏洞。攻击者利用该漏洞通过amavisd上传任意文件，导致对其他用户帐户的错误访问。

Description

Zimbra Collaboration (ZCS) Arbitrary File Upload Vulnerability

Readme

# CVE-2022-41352 PoC

 ## How does this detection method work?

As stated on the advisories an issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0, the template looks at the following versions:

```
          - "8.8.15"
          - "9.0"
```

 ## How do I run this script?

1. Download Nuclei from [here](https://github.com/projectdiscovery/nuclei)
2. Copy the template to your local system
3. Run the following command: `nuclei -u https://yourHost.com -t template.yaml` 

## References

- https://nvd.nist.gov/vuln/detail/cve-2022-41352
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html#
- https://forums.zimbra.org/viewtopic.php?t=71153&p=306532


## Disclaimer

Use at your own risk, I will not be responsible for illegal activities you conduct on infrastructure you do not own or have permission to scan.

File Snapshot


 [4.0K]  /data/pocs/5663011bd58c2e3e83f5696a96d6b8bc22ac9096
├── [ 869]  README.md
└── [1.2K]  template.yaml

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!