CVE-2022-41352: Zimbra Collaboration Path Traversal Flaw

CVE-2022-41352 Overview

CVE-2022-41352 is a critical path traversal vulnerability affecting Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0. The vulnerability exists in the way Zimbra's amavis component handles archive extraction using the cpio utility. An attacker can exploit this flaw to upload arbitrary files to the web-accessible directory /opt/zimbra/jetty/webapps/zimbra/public, enabling unauthorized access to other user accounts and potentially achieving remote code execution on the affected server.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can leverage this flaw to upload malicious web shells, gain persistent access to the mail server, and compromise sensitive email communications across the organization.

Affected Products

• Zimbra Collaboration Suite 8.8.15 (all patch levels through p33)
• Zimbra Collaboration Suite 9.0.0 (all patch levels through p26)
• Red Hat/CentOS-based installations lacking the pax utility are particularly vulnerable

Discovery Timeline

• September 26, 2022 - CVE-2022-41352 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2022-41352

Vulnerability Analysis

This vulnerability stems from how Zimbra Collaboration Suite processes email attachments through its amavis mail scanning component. When amavis receives an email with a compressed attachment (such as a TAR or CPIO archive), it extracts the contents for malware scanning. The extraction process relies on either the pax or cpio utility, with cpio being used as a fallback when pax is not available.

The cpio utility has a well-known limitation in that it does not properly sanitize file paths during extraction. An attacker can craft a malicious archive containing files with directory traversal sequences (such as ../) in their filenames. When amavis uses cpio to extract such an archive, the malicious files are written outside the intended extraction directory, specifically to Zimbra's publicly accessible web directory at /opt/zimbra/jetty/webapps/zimbra/public.

This allows an attacker to upload arbitrary files, including JSP web shells, which can then be accessed via HTTP to execute commands on the server with the privileges of the Zimbra user account.

Root Cause

The root cause of CVE-2022-41352 is the insecure handling of archive extraction by the cpio utility combined with insufficient path validation in Zimbra's amavis integration. The cpio utility does not strip or block path traversal sequences from filenames within archives, allowing attackers to write files to arbitrary locations on the filesystem where the Zimbra process has write permissions.

The issue is exacerbated by the fact that pax (which properly handles path traversal) is not installed by default on Red Hat Enterprise Linux 7 and later, or CentOS 7 and later distributions. While pax is a prerequisite for Zimbra on Ubuntu-based installations, administrators running Zimbra on RHEL/CentOS systems may unknowingly be running with the vulnerable cpio fallback.

Attack Vector

The attack vector for CVE-2022-41352 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by simply sending a specially crafted email to any user on the vulnerable Zimbra server.

The attack flow involves crafting a malicious TAR or CPIO archive containing a web shell with path traversal sequences in the filename. This archive is then attached to an email and sent to the target Zimbra server. When the email is processed by amavis for spam/malware scanning, the archive is extracted using cpio, which writes the web shell to the public web directory. The attacker can then access the uploaded web shell via HTTP to execute arbitrary commands on the server.

Detection Methods for CVE-2022-41352

Indicators of Compromise

• Unexpected JSP, PHP, or other executable files in /opt/zimbra/jetty/webapps/zimbra/public/
• Suspicious HTTP requests to the /zimbra/public/ directory accessing non-standard files
• Email attachments containing TAR/CPIO archives with path traversal sequences (../) in filenames
• Web shell activity such as command execution through web requests to the Zimbra server

Detection Strategies

• Monitor the /opt/zimbra/jetty/webapps/zimbra/public/ directory for new file creations, particularly executable files like .jsp, .sh, or .py
• Implement network intrusion detection rules to identify emails containing archives with path traversal patterns
• Review amavis extraction logs for unusual file paths or extraction errors
• Analyze web server access logs for requests to unexpected files in the public directory

Monitoring Recommendations

• Deploy file integrity monitoring (FIM) on the Zimbra web application directories to detect unauthorized modifications
• Configure SIEM alerts for suspicious HTTP POST requests followed by unusual process spawning on the Zimbra server
• Monitor for outbound connections from the Zimbra server to unknown external hosts, which may indicate post-exploitation activity

How to Mitigate CVE-2022-41352

Immediate Actions Required

• Install the pax utility on affected systems immediately using yum install pax (RHEL/CentOS) or apt-get install pax (Ubuntu/Debian)
• Apply the latest Zimbra security patches as documented in the Zimbra Security Advisories
• Review the /opt/zimbra/jetty/webapps/zimbra/public/ directory for any unauthorized or suspicious files
• Consider temporarily disabling amavis if immediate patching is not possible and the risk is acceptable

Patch Information

Zimbra has released security patches to address CVE-2022-41352. Administrators should upgrade to the latest available patch level for their Zimbra version. Detailed patching instructions are available through the Zimbra Security Center and the Zimbra Forum Discussion. Additionally, Zimbra recommends ensuring that the pax utility is installed on the system, as amavis will automatically prefer pax over cpio when both are available.

Workarounds

• Install pax on the system to ensure amavis uses the secure extraction method instead of cpio
• Disable cpio extraction in amavis configuration if patching is delayed
• Block emails containing TAR/CPIO attachments at the mail gateway as a temporary measure
• Implement web application firewall rules to restrict access to the /zimbra/public/ directory

# Install pax on RHEL/CentOS systems
yum install pax

# Install pax on Ubuntu/Debian systems
apt-get install pax

# Verify pax is installed and will be used by amavis
which pax
# Expected output: /usr/bin/pax

# Check for suspicious files in the public directory
find /opt/zimbra/jetty/webapps/zimbra/public/ -type f -name "*.jsp" -o -name "*.sh"