CVE-2024-45519

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2024-45519 10.0

Synacor · Zimbra Collaboration Suite (ZCS) · Added 2024-10-03 · Published 2024-10-02

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilitySynacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

VendorSynacor

ProductZimbra Collaboration Suite (ZCS)

Date added2024-10-03

Due date2024-10-24

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWECWE-78

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Descriptions

KEV: Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.

NVD: The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-09 08:42 UTC

Searches4

Component defaultno

Sources https://nvd.nist.gov/vuln/detail/CVE-2024-45519
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
https://wiki.zimbra.com/wiki/Security_Center
https://blog.projectdiscovery.io/zimbra-remote-code-execution/
https://github.com/Chocapikk/CVE-2024-45519
https://github.com/p33d/CVE-2024-45519
https://www.sentinelone.com/vulnerability-database/cve-2024-45519/
https://www.helpnetsecurity.com/2024/10/02/cve-2024-45519-exploited/
https://socradar.io/blog/rce-vulnerability-in-zimbra-cve-2024-45519/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt Postfix mail logs for RCPT TO: addresses containing $(echo${IFS}...) command substitution that break popen() double-quoted context in Zimbra postjournal read_maps; Chocapikk PoC injects base64 bash reverse shell via SMTP on port 25.

Research details

Componentpostjournal service read_maps function — passes unsanitized user input from SMTP RCPT TO: address directly to popen() without any sanitization or execvp array-based escaping

PreconditionsThe Zimbra postjournal service must be explicitly enabled via 'zmlocalconfig -e postjournal_enabled=true' followed by 'zmcontrol restart'. The attacker must have unauthenticated SMTP access to the Zimbra server on port 25 (or the internal postjournal port 10027 on loopback). Exploitation over the network requires the attacker source IP to fall within the Zimbra mynetworks CIDR range (checked via 'postconf mynetworks'), which defaults to loopback plus the server public IP range. The RCPT TO: address in the SMTP session must contain a shell command substitution payload using dollar-paren syntax that breaks out of the double-quoted popen command string. Affects ZCS versions before 8.8.15 Patch 46, 9.0.0 before Patch 41, 10.0 before 10.0.9, and 10.1 before 10.1.1. agent

DeliveryChocapikk PoC (exploit.py) opens a raw SMTP connection and sends: EHLO, MAIL FROM with a random address, RCPT TO with an injected payload in the form '"aabbb$(echo${IFS}<base64_revshell>|base64${IFS}-d|bash)"@domain.com', DATA with a test message, then QUIT. The postjournal service extracts the RCPT TO: address, passes it to read_maps which builds a command string and calls popen(). The command substitution syntax breaks out of the double-quoted command string context, executing the attacker's payload as the zimbra user. A pwncat listener on the attacker's port receives the reverse shell.

Public PoCyes

PoC URLs https://github.com/Chocapikk/CVE-2024-45519
https://blog.projectdiscovery.io/zimbra-remote-code-execution/ Third-party repos; verify before use.

Advisoryhttps://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 10.0). The Chocapikk PoC (139 stars) is a fully weaponized Python exploit (exploit.py) that opens a pwncat reverse shell. It generates a base64-encoded bash reverse shell payload, wraps it in command substitution syntax inside a crafted SMTP RCPT TO: address, and sends it via a standard SMTP session to the target on port 25. The ProjectDiscovery blog provides a detailed walkthrough of the binary reversing: the unpatched read_maps function builds a command string with user input and passes it to popen(); the patched version replaces popen with execvp (which uses an argv array, preventing injection) and adds an is_safe_input() function that rejects shell metacharacters including semicolons, pipes, ampersands, backticks, and dollar signs. The Nuclei template (CVE-2024-45519) uses curl with IFS for OOB detection. In-the-wild exploitation was mass-observed within days of PoC release. The popen command string is wrapped in double quotes, so simple shell metacharacters are insufficient — the dollar-paren subshell syntax is required to break out of the quoted context.

SummaryCVE-2024-45519 is a critical (CVSS 10.0) unauthenticated remote code execution vulnerability in Zimbra Collaboration Suite's postjournal service, which is used for compliance email archiving. The postjournal binary's read_maps function constructs a shell command string incorporating the recipient email address from the SMTP RCPT TO: command and passes it directly to popen() without sanitization, allowing an attacker to inject arbitrary OS commands via command substitution syntax in the RCPT TO: address field. The service is not enabled by default but when activated it processes SMTP traffic on port 25 (and internally on port 10027). Exploitation from the network is constrained by the Postfix mynetworks relay restriction, but misconfigured instances with broad CIDR ranges are fully exposed. The vulnerability was patched in ZCS 8.8.15 Patch 46 (September 4, 2024) by replacing popen with execvp and adding input sanitization. Actively exploited in-the-wild within days of public disclosure.

Tia coverage

First reported2026-09-24

First exploit report2026-09-24

Exploit report → KEV721 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

when-business-email-compromise-starts-rewriting-reality

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.