Researchers: hackers are actively exploiting an RCE vulnerability in Zimbra email servers, disclosed on September 27, triggered by emailing the SMTP server
When the mail server handles an email address with shell escape characters, the postjournal binary just shells out and runs whatever is specified. … Will Dormann / @wdormann@infosec.exchange : “Best email money can buy” product Zimbra has an embarrassingly bad vulnerability: CVE-2024-45519 — The vulnerable code appends the attacker-provided email address to a command line and then runs it with popen() (which uses a shell). Guess what happens when the email address has a backticks, a semicolon, $(), etc? … Kevin Beaumont / @GossiTheDog@cyberplace.social : If you run Zimbra you might want to shut it down until you can patch. This is a log4shell style vuln which is, uh, going to lead to coin miners or whatever kids do nowadays (crime). https://infosec.exchange/... Dan Goodin / @dangoodin@infosec.exchange : Does anyone have visibility into the ongoing exploitation of the Zimbra vulnerability CVE-2024-45519? Seems like exploitation would be fairly easy if all that's required is sending a malformed email. Further, the ability to remotely execute code seems like this would heighten the severity level. … X: @threatinsight : Beginning on September 28, @Proofpoint began observing attempts to exploit CVE-2024-45519, a remote code execution vulnerability in Zimbra mail servers. The emails spoofing Gmail were sent to bogus addresses in the CC fields in an attempt for Zimbra servers to parse and execute [image] Ivan Kwiatkowski / @justicerage : If you're using @Zimbra, mass-exploitation of CVE-2024-45519 has begun. Patch yesterday. Malicious emails are coming from 79.124.49[.]86 and attempting to curl a file from that IP. [image] Binni Shah / @binitamshah : Zimbra - Remote Command Execution (CVE-2024-45519) : https://blog.projectdiscovery.io/ ... credits @Parth_Malhotra [image] Forums: BeauHD / Slashdot : Attackers Exploit Critical Zimbra Vulnerability Using CC'd Email Addresses
Context & Ripple Effects
This report moves the Zimbra incident from disclosure to observed mass exploitation: Proofpoint saw attempts shortly after disclosure, and researchers describe crafted SMTP messages reaching the vulnerable command-handling path. It also follows a previously patched Zimbra zero-day used to steal government data, underscoring that mail-server flaws can become high-value entry points.
The broader coverage includes critical RCE issues in another mail-transfer agent, Exim, making this a recurring operational risk for organizations running internet-facing email infrastructure.
First-order effects
- Zimbra administrators face an immediate patch-or-shut-down decision because an attacker can trigger command execution by sending a specially formed email; exploitation does not depend on an employee opening a message.
- Organizations with exposed, unpatched servers must treat the issue as a potential server compromise and investigate for follow-on commands or downloaded payloads, as attempts have already sought to retrieve payloads.
Second-order effects
- Security teams will need to prioritize mail-server asset discovery, SMTP exposure review, and patch verification over routine maintenance, since the vulnerable parsing path can be reached through normal inbound mail flow.
- The active campaign raises the cost of delayed remediation for Zimbra deployments and reinforces scrutiny of mail platforms after the initial exploitation reports identified the same flaw.
Third-order effects
- Repeated RCE disclosures across Zimbra and Exim point to email infrastructure remaining a concentrated attack surface: a compromise can bypass the user-focused controls organizations commonly emphasize.
- If attackers continue to operationalize newly disclosed mail-server bugs quickly, vendors and operators will face pressure to reduce shell-dependent processing paths and shorten emergency-patching cycles.
The trend: Actively exploited mail-server RCEs are driving a broader shift toward treating email infrastructure as continuously exposed production security infrastructure rather than a periodically maintained back-office service.