{"uuid": "5b1197e5-d8eb-45c7-ba3f-38f7990f143d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-41352", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_cpio_cve_2022_41352.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Alexander Cherepanov\", \"yeak\", \"Ron Bowes\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module creates a .tar file that can be emailed to a Zimbra server\\n          to exploit CVE-2022-41352. If successful, it plants a JSP-based\\n          backdoor in the public web directory, then executes that backdoor.\\n\\n          The core vulnerability is a path-traversal issue in the cpio command-\\n          line utlity that can extract an arbitrary file to an arbitrary\\n          location on a Linux system (CVE-2015-1197). Most Linux distros have\\n          chosen not to fix it.\\n\\n          This issue is exploitable on Red Hat-based systems (and other hosts\\n          without pax installed) running versions:\\n\\n          * Zimbra Collaboration Suite 9.0.0 Patch 26 (and earlier)\\n          * Zimbra Collaboration Suite 8.8.15 Patch 33 (and earlier)\\n\\n          The patch simply makes \\\"pax\\\" a pre-requisite.\", \"disclosure_date\": \"2022-06-28\", \"fullname\": \"exploit/linux/http/zimbra_cpio_cve_2022_41352\", \"is_install_path\": true, \"mod_time\": \"2022-11-23 13:09:47 +0000\", \"name\": \"TAR Path Traversal in Zimbra (CVE-2022-41352)\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/zimbra_cpio_cve_2022_41352.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/zimbra_cpio_cve_2022_41352\", \"references\": [\"CVE-2022-41352\", \"URL-https://forums.zimbra.org/viewtopic.php?t=71153&p=306532\", \"URL-https://blog.zimbra.com/2022/09/security-update-make-sure-to-install-pax-spax/\", \"URL-https://www.openwall.com/lists/oss-security/2015/01/18/7\", \"URL-https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html\", \"URL-https://attackerkb.com/topics/1DDTvUNFzH/cve-2022-41352/rapid7-analysis\", \"URL-https://attackerkb.com/topics/FdLYrGfAeg/cve-2015-1197/rapid7-analysis\", \"URL-https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P27\", \"URL-https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P34\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Zimbra Collaboration Suite\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:04.283981Z"}