CVE-2022-37393

Zimbra zmslapd arbitrary module load

Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.

Affected

Synacor · Zimbra Server

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.67% chance of exploitation in the next 30 days, 76th percentile

Published

2022-08-16

Updated

2024-09-17

Proof-of-concept exploits (1)

• https://attackerkb.com/topics/92AeLOE1M1/cve-2022-37393/rapid7-analysis

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/zimbra_slapper_priv_…

Security advisories

• https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit
• rapid7/metasploit-framework/pull/16807

References

• CVE Record
• NVD entry