CVE-2024-33535: Zimbra Collaboration Path Traversal Flaw

CVE-2024-33535 Overview

CVE-2024-33535 is an unauthenticated local file inclusion (LFI) vulnerability affecting Zimbra Collaboration Suite (ZCS) versions 9.0 and 10.0. The flaw resides in the handling of the packages parameter within a Zimbra web application component. Attackers can supply crafted values to include arbitrary files from a specific directory on the server without authentication. Successful exploitation exposes sensitive configuration data, application resources, or other readable files within the accessible path. The issue is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory and has been addressed in Zimbra 10.0.8 and Zimbra 9.0.0 Patch 40.

Critical Impact
Remote, unauthenticated attackers can read arbitrary files within an accessible directory on Zimbra servers, exposing sensitive information that may enable further compromise.

Affected Products

Zimbra Collaboration Suite 9.0.0 (through Patch 39)
Zimbra Collaboration Suite 10.0 (prior to 10.0.8)
Zimbra Collaboration web application packages parameter handler

Discovery Timeline

2024-08-12 - CVE-2024-33535 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33535

Vulnerability Analysis

The vulnerability is a classic path traversal and local file inclusion issue in a Zimbra Collaboration web endpoint. The affected component accepts a packages request parameter and uses its value to locate and return a file from the server. Insufficient validation of that user-controlled input allows attackers to break out of the intended directory and reference other files inside the accessible scope. Because the endpoint does not require authentication, any attacker with network reachability to the Zimbra web interface can invoke it. The vulnerability affects confidentiality but does not directly allow code execution or file modification.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, categorized as [CWE-22]. The application constructs a file path by concatenating a base directory with the attacker-supplied packages value without normalizing traversal sequences or enforcing a strict allowlist. This design gap permits inclusion of unintended files that fall within the same accessible directory tree.

Attack Vector

An attacker sends an unauthenticated HTTP request to the vulnerable Zimbra endpoint with a manipulated packages parameter. The server resolves the crafted path and returns the referenced file contents in the response. Because the vector is network-based with no privileges or user interaction required, the attack can be automated at scale against internet-exposed Zimbra deployments. Exposed data typically includes application resource files residing under the target directory, which may reveal configuration details useful for chaining subsequent attacks. Technical details are documented in the Zimbra 10.0.8 Security Fixes and Zimbra 9.0.0 P40 Security Fixes advisories.

Detection Methods for CVE-2024-33535

Indicators of Compromise

HTTP requests to Zimbra web endpoints containing a packages query parameter with path traversal sequences such as ../ or absolute path fragments.
Unauthenticated access patterns to package-related URLs from external or unexpected source IP addresses.
Web server or Zimbra access logs showing sequential enumeration of files via the packages parameter.

Detection Strategies

Inspect Zimbra HTTP access logs for anomalous values in the packages parameter, particularly containing traversal sequences or unusual file extensions.
Deploy web application firewall (WAF) rules that flag or block path traversal patterns in query strings targeting Zimbra endpoints.
Correlate unauthenticated file-read requests with subsequent authentication or privilege events to identify staged intrusion attempts.

Monitoring Recommendations

Continuously monitor internet-facing Zimbra servers for unauthenticated requests to package handling endpoints.
Alert on high-volume or scripted enumeration against the packages parameter, which suggests automated exploitation.
Track outbound data volumes and response sizes from Zimbra web services to identify unusual file-content disclosure.

How to Mitigate CVE-2024-33535

Immediate Actions Required

Upgrade Zimbra Collaboration 10.0.x deployments to version 10.0.8 or later.
Upgrade Zimbra Collaboration 9.0.0 deployments to Patch 40 (9.0.0 P40) or later.
Restrict network exposure of the Zimbra web interface to trusted networks or authenticated proxies where feasible.
Review Zimbra web server logs for evidence of prior exploitation attempts against the packages parameter.

Patch Information

Zimbra has released fixes in Zimbra 10.0.8 and Zimbra 9.0.0 Patch 40. Administrators should apply these updates promptly, as the vulnerability is network-exploitable without authentication.

Workarounds

Place the Zimbra web interface behind a reverse proxy or WAF that blocks path traversal payloads in the packages parameter.
Restrict access to affected endpoints via IP allowlisting until patches are applied.
Rotate any credentials, tokens, or keys stored in files accessible to the Zimbra web application if compromise is suspected.

bash

# Example WAF rule concept: block traversal sequences in the packages parameter
# (ModSecurity-style pseudocode - adapt to your WAF platform)
SecRule ARGS:packages "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1003353,phase:2,deny,status:403,\
    msg:'CVE-2024-33535 Zimbra LFI attempt in packages parameter'"