A zero-day flaw within the Zimbra Collaboration e-mail software program was exploited by 4 totally different teams in real-world assaults to pilfer e-mail knowledge, consumer credentials, and authentication tokens.
“Most of this exercise occurred after the preliminary repair turned public on GitHub,” Google Risk Evaluation Group (TAG) mentioned in a report shared with The Hacker Information.
The flaw, tracked as CVE-2023-37580 (CVSS rating: 6.1), is a mirrored cross-site scripting (XSS) vulnerability impacting variations earlier than 8.8.15 Patch 41. It was addressed by Zimbra as a part of patches launched on July 25, 2023.
Profitable exploitation of the shortcoming may enable execution of malicious scripts on the victims’ net browser just by tricking them into clicking on a specifically crafted URL, successfully initiating the XSS request to Zimbra and reflecting the assault again to the consumer.
Google TAG, whose researcher Clément Lecigne was credited with discovering and reporting the bug, mentioned it found a number of marketing campaign waves beginning June 29, 2023, no less than two weeks earlier than Zimbra issued an advisory.
Three of the 4 campaigns have been noticed previous to the discharge of the patch, with the fourth marketing campaign detected a month after the fixes have been printed.
The primary marketing campaign is alleged to have focused a authorities group in Greece, sending emails containing exploit URLs to their targets that, when clicked, delivered an email-stealing malware beforehand noticed in a cyber espionage operation dubbed EmailThief in February 2022.
The intrusion set, which Volexity codenamed as TEMP_HERETIC, additionally exploited a then-zero-day flaw in Zimbra to hold out the assaults.
The second risk actor to use CVE-2023-37580 is Winter Vivern, which focused authorities organizations in Moldova and Tunisia shortly after a patch for the vulnerability was pushed to GitHub on July 5.
It is value noting that the adversarial collective has been linked to the exploitation of safety vulnerabilities in Zimbra Collaboration and Roundcube by Proofpoint and ESET this yr.
TAG mentioned it noticed a 3rd, unidentified group weaponizing the bug earlier than the patch was pushed on July 25 to phished for credentials belonging to a authorities group in Vietnam.
“On this case, the exploit URL pointed to a script that displayed a phishing web page for customers’ webmail credentials and posted stolen credentials to a URL hosted on an official authorities area that the attackers probably compromised,” TAG famous.
Lastly, a authorities group in Pakistan was focused utilizing the flaw on August 25, ensuing within the exfiltration of the Zimbra authentication token to a distant area named “ntcpk[.]org.”
Google additional identified a sample through which risk actors are repeatedly exploiting XSS vulnerabilities in mail servers, necessitating that such functions are audited completely.
“The invention of no less than 4 campaigns exploiting CVE-2023-37580, three campaigns after the bug first turned public, demonstrates the significance of organizations making use of fixes to their mail servers as quickly as doable,” TAG mentioned.
“These campaigns additionally spotlight how attackers monitor open-source repositories to opportunistically exploit vulnerabilities the place the repair is within the repository, however not but launched to customers.”
