CVE-2025-54390: Zimbra Collaboration CSRF Vulnerability

CVE-2025-54390 Overview

CVE-2025-54390 is a Cross-Site Request Forgery (CSRF) vulnerability in the ResetPasswordRequest operation of Zimbra Collaboration Suite (ZCS). The flaw exists when the zimbraFeatureResetPasswordStatus attribute is enabled on the server. An attacker can trick an authenticated Zimbra user into visiting a malicious webpage that silently submits a crafted SOAP request to the mail server. The endpoint lacks CSRF token validation, so the server processes the request as legitimate and resets the victim's password without consent. Successful exploitation results in account takeover of the affected Zimbra mailbox.

Critical Impact
Attackers can hijack Zimbra user accounts by forcing an unauthorized password reset through a malicious webpage, gaining full access to the victim's mailbox and associated collaboration data.

Affected Products

Zimbra Collaboration Suite (ZCS) instances with zimbraFeatureResetPasswordStatus enabled
Zimbra web client sessions using authenticated SOAP endpoints
Zimbra deployments exposing the mail service to browser-driven CSRF flows

Discovery Timeline

2025-09-17 - CVE-2025-54390 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54390

Vulnerability Analysis

The vulnerability affects the SOAP-based ResetPasswordRequest operation exposed by Zimbra Collaboration. When an administrator enables the zimbraFeatureResetPasswordStatus attribute, users can reset their own passwords through the web client. The endpoint accepts authenticated requests but does not verify a CSRF token or an equivalent anti-forgery mechanism. Any origin capable of causing the victim's browser to submit a same-site authenticated request can therefore drive a password change. This maps to [CWE-352] Cross-Site Request Forgery. Post-exploitation, the attacker authenticates with the new credentials and gains full mailbox access, enabling data theft, business email compromise, and lateral movement through mailbox delegation.

Root Cause

The root cause is the absence of CSRF token validation on the ResetPasswordRequest SOAP handler. Zimbra relies on the authenticated session cookie to authorize the operation, without binding the request to a token that a cross-origin page cannot obtain. Browsers automatically attach the session cookie when a malicious page issues a crafted request to the Zimbra host, so server-side authorization succeeds even though the user never initiated the action.

Attack Vector

Exploitation requires an authenticated Zimbra user to visit an attacker-controlled webpage while their Zimbra session is active. The malicious page issues a forged SOAP request, typically as a form submission or fetch call, targeting the Zimbra mail endpoint. The server processes the request using the victim's session context and updates the account password. The attack requires user interaction (visiting the page) but no privileges on the target server. No verified public proof-of-concept code is available at this time. See the Zimbra Security Advisories for vendor-specific technical details.

Detection Methods for CVE-2025-54390

Indicators of Compromise

Unexpected ResetPasswordRequest SOAP calls in Zimbra mailbox.log originating from sessions with unusual Referer or Origin headers
Password change events for user accounts that did not open a support ticket or self-service request
Successful logins from new IP addresses or geolocations immediately following a password reset event
Outbound mailbox rule creation, forwarding rule additions, or bulk message access shortly after a password change

Detection Strategies

Alert on ResetPasswordRequest SOAP operations where the HTTP Referer or Origin header does not match an approved Zimbra web client hostname
Correlate password reset events with the user's recent web activity to identify resets that were not preceded by a self-service navigation flow
Baseline the volume of zimbraFeatureResetPasswordStatus-driven resets per tenant and flag statistical anomalies

Monitoring Recommendations

Forward Zimbra mailbox.log, audit.log, and web server access logs to a centralized log platform for retention and correlation
Monitor authentication events tied to accounts within 24 hours of any password reset for follow-on abuse
Track outbound SMTP volume and mailbox rule changes for users whose passwords were recently reset

How to Mitigate CVE-2025-54390

Immediate Actions Required

Apply the Zimbra security patch referenced in the Zimbra Security Center as soon as it is available for your ZCS version
Disable the zimbraFeatureResetPasswordStatus attribute on all accounts and cloud-of-service (COS) definitions until patching is complete
Force password rotation for any account whose reset activity cannot be attributed to a legitimate user action
Invalidate active Zimbra sessions to eliminate any attacker sessions established via forged resets

Patch Information

Zimbra publishes patched builds through the Zimbra Security Advisories page. Administrators should review the advisory matching CVE-2025-54390 and upgrade to the fixed ZCS version. Follow the vendor's Responsible Disclosure Policy page for coordinated remediation timelines.

Workarounds

Set zimbraFeatureResetPasswordStatus to FALSE at the COS or account level to disable the vulnerable self-service reset flow
Enforce short session lifetimes and require re-authentication for sensitive operations to shrink the CSRF exploitation window
Deploy a web application firewall rule that blocks ResetPasswordRequest SOAP calls lacking a valid same-origin Referer or Origin header
Educate users to log out of the Zimbra web client when browsing untrusted sites

bash

# Configuration example: disable the vulnerable self-service reset feature
# Run as the zimbra user on the mailbox server
zmprov mc default zimbraFeatureResetPasswordStatus disabled

# Verify the setting was applied
zmprov gc default | grep zimbraFeatureResetPasswordStatus