Zimbra webmail server unauthenticated POST to mboximport backup servlet leading to RCE attempts

title: Zimbra webmail server unauthenticated POST to mboximport backup servlet leading to RCE attempts
id: 18001240-d0d2-4cee-9fd7-ea35ddfc2773
status: test
description: This rule flags HTTP POST requests to the Zimbra mboximport backup servlet with specific query parameters commonly associated with an unauthenticated command injection attempt. Attackers can use this endpoint to execute remote code without valid credentials, making it high-risk. Detection relies on web server request telemetry including HTTP method, requested URI/query string contents, and observed response status codes.
references:
  - https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
  - https://www.yang99.top/index.php/archives/82/
  - https://github.com/vnhacker1337/CVE-2022-27925-PoC
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-27925/web_cve_2022_27925_exploit.yml
author: "@gott_cyber, Huntrule Team"
date: 2022-08-17
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-27925
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_servlet:
    cs-method: POST
    cs-uri-query|contains: /service/extension/backup/mboximport\?
    cs-uri-query|contains|all:
      - account-name
      - ow
      - no-switch
      - append
    sc-status:
      - 401
      - 200
  selection_shell:
    cs-uri-query|contains: /zimbraAdmin/
    cs-uri-query|endswith: .jsp
    sc-status|contains: "200"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: dd218fb6-4d02-42dc-85f0-a0a376072efd
    type: derived