# Attackers Target Zimbra Servers: Critical Vulnerability Exploited via CC'd Emails! ⚠️

**URL:** <https://onehack.st/t/attackers-target-zimbra-servers-critical-vulnerability-exploited-via-ccd-emails/292688>\
**Category:** News & Articles\
**Tags:** hacking, email\
**Created:** [October 3, 2024, 5:52pm UTC](https://onehack.st/t/attackers-target-zimbra-servers-critical-vulnerability-exploited-via-ccd-emails/292688 "2024-10-03T17:52:55Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheJoker](https://onehack.st/user_avatar/onehack.st/thejoker/32/22660_2.png) [@TheJoker](https://onehack.st/u/TheJoker)\
**Post date:** [October 3, 2024, 5:52pm UTC](https://onehack.st/t/attackers-target-zimbra-servers-critical-vulnerability-exploited-via-ccd-emails/292688/1 "2024-10-03T17:52:55Z")

</div>

**Summary:**

1. **Critical Vulnerability Discovered**  
Researchers have identified a critical vulnerability (CVE-2024-45519) in Zimbra mail servers that allows attackers to execute malicious commands remotely, potentially installing a backdoor on affected systems.

2. **Exploitation Details**  
The vulnerability can be exploited when administrators manually enable the postjournal service. Attackers can send specially crafted emails to addresses hosted on the server to execute harmful commands.

3. **Mass Exploitation Reported**  
Security researcher Ivan Kwiatkowski reported ongoing mass exploitation of this vulnerability, with malicious emails originating from the IP address 79.124.49[.]86, attempting to run files via the curl tool.

4. **Malicious Email Tactics**  
The attackers used a CC list encoded in base64, which when decoded created a webshell on vulnerable Zimbra servers at the path: /jetty/webapps/zimbraAdmin/public/jsp/zimbraConfig.jsp. This webshell can listen for connections and execute commands based on received cookies.

5. **Recommended Actions**  
Zimbra has released a patch for this vulnerability, and all users are urged to apply it. At a minimum, administrators should ensure that the postjournal service is disabled to mitigate risk.

**Read more at:** [Ars Technica](https://arstechnica.com/security/2024/10/attackers-exploit-critical-vulnerability-recently-patched-in-zimbra-servers/) | [Zimbra Security Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)