A Local File Inclusion (LFI) vulnerability in the /h/rest endpoint, allowing authorized remote attackers to access sensitive files in the WebRoot using their valid auth tokens, has been fixed to prevent unauthorized file access.

A Local File Inclusion (LFI) vulnerability in the /h/rest endpoint, allowing authorized remote attackers to access sensitive files in the WebRoot using their valid auth tokens, has been fixed to prevent unauthorized file access.

Severity

8

CVSS

(AV:N/AC:L/Au:N/C:C/I:N/A:N)

Published

12/19/2024

Created

01/16/2025

Added

01/10/2025

Modified

01/20/2025

Description

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.

Solution(s)

• zimbra-collaboration-upgrade-latest

References

• https://attackerkb.com/topics/cve-2024-54663
• CVE - 2024-54663
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3#Security_Fixes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes