CVE-2025-68645 Scanner

Zimbra Collaboration, often abbreviated as ZCS, is a popular software solution used by businesses and organizations for email and collaboration purposes. It features email, group calendars, contacts, and file-sharing capabilities, providing a comprehensive communication suite. Typically deployed in enterprise and academic environments, Zimbra is available both on-premises and as a cloud-based service. The platform is favored for its integrated and modular approach, allowing users to manage communications effectively. Due to its wide usage, maintaining its security is paramount to protecting sensitive organizational data.

The vulnerability addressed by this scanner is Local File Inclusion (LFI), a type of security flaw that allows unauthorized users to include files on a server through the web browser. In this particular case, the vulnerability affects the RestFilter servlet within Zimbra Collaboration versions 10.0 and 10.1. Improper handling of user-supplied parameters can lead unauthorized attackers to exploit this flaw by crafting specific requests. As a consequence, arbitrary files from WebRoot can be inadvertently included and exposed.

Technically, the vulnerability exists within the /h/rest endpoint of the Zimbra Collaboration application. Attackers can manipulate requests to include files unintentionally due to the servlet's inadequate input validation. For instance, by adjusting the servlet_path parameter to a known file within the WebRoot, like /WEB-INF/web.xml, hackers can retrieve file contents without proper authorization. This vulnerability highlights the critical need for secure parameter handling, particularly in endpoints that process user inputs.

If exploited, this local file inclusion vulnerability could have serious consequences. Unauthorized access to files may lead to information disclosure, enabling attackers to access sensitive configurations or internal documents. This can result in increased vulnerability to further attacks, such as gaining administrative access or launching more sophisticated phishing attacks or malware injections. Protecting against this vulnerability is essential in maintaining the integrity and confidentiality of affected systems.

REFERENCES

• https://x.com/sirifu4k1/status/2006031417088639064