Zimbra Exploit XXE-SSRF-CVE 2019-9621.yml

title: Zimbra Vulnerability SSRF/XXE CVE 2019-9621
status: experimental
author: A.W. Networksecure Segurança da Informação LTDA.
date: 2023/08/10
modification: 2023/08/05
description: Possible Exploit vulnerability CVE 2019-9621 through puyblic exploit 
references:
  - https://www.exploit-db.com/exploits/46967
  - https://github.com/k8gege/ZimbraExploit/tree/master
  - https://xz.aliyun.com/t/7991
tags:
  - attack.TA0042
logsource:
  category:
    - proxy 
    - alert
  product:
    - waf
    - proxy 
detection:
  selection:
    http_method: POST
    url: 
      - js/zimbraMail/share/model/ZmSettings.js
      - .dtd
      - '/Autodiscover/Autodiscover.xml'
      - /service/proxy?target=https://127.0.0.1:7071/service/admin/soap
      - webmail.exemplo.com.br/downloads/shell.jsp
    destination port: 7071
  condition: AND, OR
fields:
  - url
  - http_method
  - destination_port
level: medium