Cve20207796 Zimbra Collaboration Suite Full [hot] May 2026

CVE-2020-7796 is a critical Server-Side Request Forgery (SSRF) vulnerability in the Zimbra Collaboration Suite (ZCS) . It has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog

, requiring organizations to remediate it promptly due to active exploitation in the wild. National Institute of Standards and Technology (.gov) Vulnerability Overview Vulnerability Type: Server-Side Request Forgery (SSRF) (CWE-918). (CVSS v3.1 score of

A remote, unauthenticated attacker can send unauthorized HTTP requests from the Zimbra server to internal or external hosts. This can lead to:

Accessing sensitive internal resources protected by firewalls. Data leakage or credential theft.

Potential for further exploitation or pivoting within the network. National Institute of Standards and Technology (.gov) Technical Analysis The flaw exists within a specific component of the suite: Trigger Component: WebEx zimlet Root Cause: Insufficient validation of user-supplied input when the zimlet JSP (Jakarta Server Pages) functionality is enabled. Exploitation:

By sending a specially crafted HTTP request to the vulnerable JSP file, an attacker forces the server to act as a proxy, making requests to other URLs on their behalf. Affected Versions Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 Remediation & Mitigation Administrators should prioritize the following actions: ZCS 8.8.15 Patch 7

or a more recent version (e.g., ZCS 10.x or 9.x latest patches) to address the core vulnerability. Disable WebEx Zimlet:

If immediate patching is not possible, organizations should consider disabling the WebEx zimlet if it is not business-critical, as this removes the attack vector. Vendor Guidance: Refer to the official Zimbra 8.8.15 P7 Release Notes for specific patching instructions. Proof of Concept (PoC) cve20207796 zimbra collaboration suite full

structure for testing your own environment against this SSRF? CVE-2020-7796 Detail - NVD

Understanding CVE-2020-7796: The SSRF Threat to Zimbra Collaboration Suite

Zimbra Collaboration Suite (ZCS) is a widely used enterprise-level email and collaboration platform. However, versions prior to 8.8.15 Patch 7 are vulnerable to a significant security flaw identified as CVE-2020-7796 What is CVE-2020-7796? CVE-2020-7796 is a Server-Side Request Forgery (SSRF)

vulnerability. It occurs due to insufficient validation of user-supplied URLs within specific components of the Zimbra application. Specifically, this vulnerability is triggered when the WebEx zimlet is installed and the zimlet JSP is enabled. How the Vulnerability Works

In an SSRF attack, an unauthenticated remote attacker can force the vulnerable Zimbra server to make HTTP requests to arbitrary internal or external hosts. Internal Proxying

: Attackers can use the server as a proxy to reach internal services that are not normally accessible from the public internet. Data Exposure

: This can lead to unauthorized access to sensitive internal data or administrative interfaces. Arbitrary Requests 4. Exploitation Status Shortly after disclosure

: The server essentially becomes a tool for the attacker to send requests to other systems under the guise of the trusted Zimbra server. Impact and Risk

: High. Because it can be exploited by unauthenticated attackers, it poses a direct risk to any exposed Zimbra instance. Potential Outcomes

: Data leakage, internal network scanning, and potential escalation if internal services have weaker authentication than public ones. Remediation: How to Protect Your Server

The primary way to mitigate this risk is to update your Zimbra installation to a secure version. Upgrade ZCS : Apply the latest patches or upgrade to Zimbra Collaboration Suite version 8.8.15 Patch 7 or higher. Verify Patching : You can check for updates and install the latest zimbra-patch package using system tools like Monitor Zimlets

: If you cannot patch immediately, consider disabling the WebEx zimlet or zimlet JSP functionality if they are not critical to your operations. For more details on official patches, refer to the Zimbra Wiki Security Center for Zimbra 8.8.15? Zimbra Collaboration Suite SSRF (CVE-2020-7796) - Acunetix

2.1 Vulnerability Description

The vulnerability exists within the unrar utility bundled with ZCS. Zimbra uses Amavis to scan email attachments for viruses and spam. Amavis calls external binaries, including unrar, to process archived files (specifically .rar files).

The specific flaw is a buffer overflow vulnerability. The version of unrar included in ZCS did not properly validate the length of user-supplied data before copying it into a fixed-length memory buffer. By crafting a malicious RAR archive with specially designed metadata or content, an attacker can trigger the buffer overflow, overwrite memory, and execute arbitrary shellcode. the attacks were not immediately destructive

6. Patch Analysis – How Zimbra Fixed It

Zimbra addressed CVE-2020-27996 in:

• ZCS 8.8.15 Patch 11
• ZCS 9.0.0 Patch 5

The fix involved:

1. Hardening the ProxyServlet to reject any requests containing ../ or system command metacharacters.
2. Introducing an authentication check for all calls to extension handlers, ensuring that unauthenticated users cannot invoke ExtensionUtil or similar classes.
3. Adding a configuration flag to disable proxy servlet access entirely from untrusted networks (default: off).

In their security advisory, Zimbra noted: "This vulnerability allows unauthenticated remote attackers to execute arbitrary commands. Immediate patching is strongly advised."

Step 4: Post-Exploitation

Once RCE is achieved:

• The attacker gains a shell as the zimbra user.
• From there, they can dump LDAP directories, read all emails, reset admin passwords, pivot to internal networks, or install ransomware.

Real-World Context

This vulnerability has been widely exploited in the wild. Shortly after the publication of the Proof of Concept (PoC) code, automated bots began scanning the internet for vulnerable Zimbra servers. Security researchers observed that threat actors were utilizing this flaw to deploy web shells (such as kthxm.jsp or variations of the "China Chopper" shell) to establish persistent access. In many cases, the attacks were not immediately destructive; instead, actors silently exfiltrated data or used the compromised mail servers to send spam and phishing emails to other organizations.

Log Evidence

• Check /opt/zimbra/log/access_log for suspicious UserServlet or ProxyServlet requests containing:

  • ../, /bin/sh, curl, wget, | bash, $IFS
  • Parameters like ext=com.zimbra.cs.extension.ExtensionUtil

• Look for mailbox.log errors indicating failed authentication proxied to localhost:7071 (admin port).

4. Exploitation Status

Shortly after disclosure, proof-of-concept (PoC) code became publicly available. Due to the ease of exploitation (sending a malicious email), this vulnerability was widely exploited in the wild by botnets and advanced persistent threat (APT) actors.

• Active Exploitation: Attackers actively scanned the internet for vulnerable Zimbra servers on ports 25 (SMTP), 80 (HTTP), and 443 (HTTPS).
• Post-Exploitation: Observed attacks typically involved downloading and executing shell scripts to install botnet clients (e.g., for DDoS) or webshells for persistent access.