SID 1:49898

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Zimbra SSRF privilege escalation attempt

Rule Explanation

This event is generated when an attempt is made to elevate privileges within Zimbra to a global administrator. Impact: Attempted Administrator Privilege Gain Details: To gain global administrator privileges, normally a call is made to port 7071 of the Zimbra server to gain an administrator token. Due to a coding deficiency within the proxy module, a remote user may craft a request to the proxy service to exploit a SSRF to this port which is typically only accessible on the local network. Ease of Attack: Medium

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group