By 
A high-severity vulnerability was discovered in the Zimbra email suite which could be exploited by an unauthenticated attacker to steal login credentials of users.
The vulnerability tracked as CVE-2022-27924 was discovered by researchers from Sonarsource and has a severity score of 7.5.
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
After obtaining the login credentials, attackers can access the victims’ mailboxes and potentially escalate their access to targeted organizations.
According to an advisory published by Sonarsource, with mail access, attackers can reset passwords, impersonate their victims, and silently read all private conversations within the targeted company.
The experts explained that Zimbra’s Reverse Proxy makes an HTTP request to the Zimbra Lookup Service for every connection it receives, before forwarding the traffic to the correct backend service.
The result of an HTTP request is cached per user by a Memcached instance to improve performance, this means that before making the HTTP request to the Lookup Service, the cache is checked for an existing route. If a cache entry exists, the Lookup request is skipped.
Memcached server stores key/value pairs that can be set and retrieved with a simple text-based protocol.
The root cause of the Memcache Injection vulnerability in Zimbra is that “newline characters (\r\n) are not escaped in untrusted user input.”
The researchers also published a video PoC that demonstrates how an unauthenticated attacker can steal the password of a known user of a targeted instance. The vulnerability is triggered the next time the victim uses a mail client to connect to the Zimbra server of a target organization.
Threat actors, who knows the victims’ email addresses, can overwrite an entry in the cache to forward all IMAP traffic to an attacker-controlled server, including the cleartext credentials of a targeted user.
In an alternative attack scenario, attackers exploit “Response Smuggling” to bypass the restrictions imposed by the first strategy and steal cleartext credentials from any vulnerable Zimbra instance.
The response smuggling technique consists of manipulating and injecting malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).
Attackers can steal users’ credentials by smuggling unauthorized HTTP responses that abuse the CRLF injection flaw to forward IMAP traffic to a rogue server, even without the knowledge of their email addresses.
