Zimbra web server: Unauthenticated RCE probing via mboximport POST requests
Alerts on unauthenticated-style Zimbra POST activity targeting the mboximport servlet with RCE-related query parameters.
- Category
- webserver
- Author
- @gott_cyber (SigmaHQ), DRL 1.1
- Published
- 2022-08-17
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies HTTP POST requests to Zimbra’s mboximport servlet with a query string containing expected parameters for unauthenticated command injection attempts. It also looks for responses indicative of successful script execution by matching access to a /zimbraAdmin/ .jsp resource returning 200. The detection relies on webserver request logs capturing method, full URI query content, and HTTP status codes.
Reporting behind it
- volexity.comhttps://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
- yang99.tophttps://www.yang99.top/index.php/archives/82/
- github.comhttps://github.com/vnhacker1337/CVE-2022-27925-PoC
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-27925/web_cve_2022_27925_exploit.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Zimbra web server: Unauthenticated RCE probing via mboximport POST requests"
id: 18001240-d0d2-4cee-9fd7-ea35ddfc2773
status: test
description: This rule identifies HTTP POST requests to Zimbra’s mboximport servlet with a query string containing expected parameters for unauthenticated command injection attempts. It also looks for responses indicative of successful script execution by matching access to a /zimbraAdmin/ .jsp resource returning 200. The detection relies on webserver request logs capturing method, full URI query content, and HTTP status codes.
references:
- https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
- https://www.yang99.top/index.php/archives/82/
- https://github.com/vnhacker1337/CVE-2022-27925-PoC
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-27925/web_cve_2022_27925_exploit.yml
author: "@gott_cyber, Huntrule Team"
date: 2022-08-17
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2022-27925
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_servlet:
cs-method: POST
cs-uri-query|contains: /service/extension/backup/mboximport\?
cs-uri-query|contains|all:
- account-name
- ow
- no-switch
- append
sc-status:
- 401
- 200
selection_shell:
cs-uri-query|contains: /zimbraAdmin/
cs-uri-query|endswith: .jsp
sc-status|contains: "200"
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: dd218fb6-4d02-42dc-85f0-a0a376072efd
type: derived