Zimbra Collaboration Suite < 8.8.15 - Improper Encoding

id: CVE-2022-24682

info:
  name: Zimbra Collaboration Suite < 8.8.15 - Improper Encoding
  author: rxerium
  severity: medium
  description: |
    An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
  impact: |
    Attackers can inject malicious JavaScript through the Calendar feature that executes in victims' browsers, potentially stealing session tokens and accessing email communications of Zimbra users.
  remediation: |
    Update Zimbra Collaboration Suite to version 8.8.15 patch 30 or later that properly escapes HTML in Calendar feature attributes.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24682
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-228a
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-24682
    epss-score: 0.3106
    epss-percentile: 0.98044
    cwe-id: CWE-116
  metadata:
    max-request: 1
    vendor: zimbra
    product: collaboration
    shodan-query:
      - http.favicon.hash:"1624375939"
      - http.html:"Zimbra Collaboration Suite Web Client"
    fofa-query: icon_hash="1624375939"
  tags: cve,cve2022,zimbra,collaboration,xss,kev,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Zimbra Collaboration Suite Web Client"

      - type: word
        part: content_type
        words:
          - "application/x-javascript"

      - type: dsl
        dsl:
          - "compare_versions(detected_version, '< 8.8.15')"
          - "compare_versions(detected_version, '> 8.7.15')"
        condition: and

    extractors:
      - type: regex
        part: body
        name: detected_version
        group: 1
        regex:
          - CLIENT_VERSION\",\s+{type:ZmSetting\.T_CONFIG, defaultValue:"([0-9.]+)_([A-Z_0-9]+)"\}
# digest: 4a0a0047304502207124e358bacb62db30e3faa52bf4ef1c082ec0e09d0780b8482faf88f83ee5ca022100c223abce6f6798d733b7723672b57b7253377273155288ce65eaa90a0f2fe73a:922c64590222798bb761d5b6d8e72950