CISAnalysis 05 August 2022

A bug discovered back in March has been added to CISA’s Known Exploited Vulnerabilities Catalog. This high severity bug, tracked as CVE-2022-27924, affects certain versions of the Zimbra email solution.

 CVE-2022-27924 allows unauthenticated attackers to steal user’s cleartext login credentials from a targeted Zimbra deployment without user interaction via a CRLF injection into the username of a Memcached lookups. This weakness is classified under CWE-74.

Memcached is a free and open source memory object caching system. It improves Zimbra’s performance by storing key/value pairs for email accounts and reducing the number of HTTP requests by the Lookup Service.  

According to researchers SonarSource, the bug’s discoverers, there are two possible exploitation techniques:

• Strategy one requires the use of known email addresses. We all know how easy it is to find email addresses online using publicly available info or by simply guessing the address based on the standard business email setup: firstname.lastname@business.com. The user must also use an IMAP client.
• Strategy two bypasses the restrictions of the first method by “Response Smuggling,” allowing the attacker to “steal cleartext credentials from any vulnerable Zimbra instance without requiring any knowledge about the instance.”

Once a user logs in, their cleartext credentials are sent to the attacker.

A patch for CVE-2022-27924 was released by Zimbra back in May that has been verified by Sonar to resolve the vulnerability by creating an SHA-256 hash of all Memcached keys before they are sent to the server.

Image: Brett Jordan

#cisanalysis #cisa #CVE-2022-27924