Zero-day vulnerability in Zimbra Servers being exploited-in-the-wild

For a detailed advisory, download the pdf file here

A zero-day cross-site scripting (XSS) vulnerability has been discovered in the Zimbra email software. A threat actor is taking advantage of this issue by launching a targeted spear-phishing attack named Operation EmailThief.

Two attack phases make up the Operation EmailThief campaign. The first phase was intended for reconnaissance, and it consisted of emails designed to simply track whether a target had received and opened the emails. The second phase targets users to click on a maliciously created link by the attacker. This attack can only succeed if the victim is using a web browser to access their Zimbra webmail client. If exploited successfully, an attacker will be able to run arbitrary JavaScript in the context of a user’s Zimbra session, then exfiltrate the data to the attacker’s C2 server.

This vulnerability has been exploited in the wild and organizations should upgrade to version 8.8.15 P30(update 1) to fix it.

Potential MITRE ATT&CK TTPs are:

TA0043: Reconnaissance

T1589: Gather Victim Identity Information

T1589.002: Gather Victim Identity Information: Email Addresses

TA0001: Initial Access

T1566: Phishing

T1566.002: Phishing: Spearphishing Link

T1189: Drive-by Compromise

TA0002: Execution

T1204: User Execution

T1204.001: User Execution: Malicious Link

T1059: Command and Scripting Interpreter

T1059.007: Command and Scripting Interpreter: JavaScript

TA0010: Exfiltration

T1041: Exfiltration Over C2 Channel

Vulnerability Detail

Indicators of Compromise (IoCs)

Patch Link