CVE-2022-27925 Detection: Mass Exploitation of Remote Code Execution (RCE) Vulnerability in Zimbra Collaboration Suite

Exploitation attempts of vulnerabilities found in Zimbra Collaboration Suite (ZCS) are coming into the spotlight in the cyber threat arena, like in the case of CVE-2018-6882 used in a targeted cyber-espionage campaign against Ukrainian state bodies in mid-April 2022. Throughout July and August 2022, cybersecurity researchers were investigating a series of security breaches affecting ZCS email servers and uncovered that the likely cause of these incidents was the exploitation of a remote code execution vulnerability (RCE) tracked as CVE-2022-27925.

Detect CVE-2022-27925 Exploitation Attempts in Zimbra Email Servers

Since hundreds of thousands of businesses worldwide use Zimbra for cross-team collaboration, security issues affecting the company’s products pose a severe threat on a global scale. To enable organizations to effectively defend against potential cyber-attacks exploiting the Zimbra CVE-2022-27925 vulnerability, SOC Prime Team has recently released a novel Sigma rule available in our Detection as Code platform. Cybersecurity practitioners can also instantly access this detection accompanied with relevant contextual information by browsing SOC Prime’s Cyber Threats Search Engine for related CVE:

Possible Zimbra Exploitation Patterns [CVE-2022-27925] (via web)

The dedicated Sigma rule is based on logs from compromised Zimbra servers and can be automatically converted to 18 SIEM, EDR, and XDR solutions supported by SOC Prime’s platform. The detection is aligned with the MITRE ATT&CK® framework addressing the Initial Access tactic and the corresponding Exploit Public-Facing Application (T1190) technique. Cybersecurity practitioners can also apply this Sigma rule to instantly search for related threats in their SIEM or EDR environment using SOC Prime’s Quick Hunt module.

To stay ahead of emerging threats affecting widely used Zimbra products, take advantage of the dedicated Sigma rule kit available in SOC Prime’s platform by clicking the Detect & Hunt button below. Non-registered SOC Prime users can also explore insightful contextual metadata by browsing the Cyber Threats Search Engine for Zimbra-related threats. Just click the Explore Threat Context button and drill down to relevant MITRE ATT&CK references, CVE descriptions, and more context-enriched information, along with a list of applicable Sigma rules within a sub-second search performance.

Detect & Hunt Explore Threat Context

CVE-2022-27925 Analysis

An authentication bypass flaw affecting Zimbra email platform is causing quite a stir. Researchers report the increasing number of exploits worldwide, totaling over 1000 compromised servers belonging to critical infrastructure entities, SMBs, SMEs, and large enterprises. Yet, the researchers face mounting evidence that the actual number of systems affected by this Zimbra RCE is far higher.

The Volexity incident research team released a comprehensive write-up detailing the ZCS breaches in July-August of 2022. According to the research data, CVE-2022-27925 required admin credentials for exploitation: another authentication vulnerability tracked as CVE-2022-37042 came to the rescue. The successful exploitation of these vulnerabilities combined enables criminal hackers to drop web shells on specific locations on the compromised servers and establish a foothold inside the breached network.

Zimbra versions 8.8.15 patch 33 or 9.0.0 patch 26 were deemed vulnerable by the vendor. The software updates to plug all of the above-mentioned security holes are already available.

Join SOC Prime’s Detection as Code platform to stay ahead of attackers equipped with curated detection content to combat current and emerging threats along with cutting-edge capabilities for enhanced cyber defense. Striving to make your own contribution to collective industry expertise by authoring detection content? Tap into the power of SOC Prime’s Threat Bounty Program and join forces with over 600 content contributors to help build a safer cyber future together while monetizing your Detection Engineering and Threat Hunting skills.