Unauthenticated LFI in Zimbra Collaboration Webmail Classic UI RestFilter

Repository is a small standalone Python proof-of-concept/operational mass scanner for CVE-2025-68645 affecting Zimbra Collaboration Suite. It contains one code file (CVE-2025-68645.py), a README, and a license. The Python script uses requests, argparse, colorama, and ThreadPoolExecutor to scan either a single target or a list of targets concurrently. Its core purpose is to detect and exploit an unauthenticated path traversal/file disclosure issue through the Zimbra endpoint /h/printconversations with the javax.servlet.include.servlet_path parameter. Main exploit capability: the script sends HTTP GET requests to a target-supplied base URL and appends traversal/file-read paths to retrieve sensitive files from the server. It first validates exploitation by requesting /WEB-INF/web.xml and checking response content for servlet/XML or Zimbra configuration indicators. If successful, it can read additional hardcoded sensitive files including localconfig.xml, ldap-config.xml, zcs-config.xml, logging properties, and other Zimbra application files. It also includes regex-based extraction logic to pull potentially useful intelligence from leaked responses, such as Zimbra version values, hostnames, email addresses, IP addresses, ports, memcached server references, trusted IPs, and generic config keys. Operational structure: banner and constants; a SENSITIVE_PATHS dictionary of target files; PATTERNS regexes for parsing leaked data; a ZimbraScanner class with methods for vulnerability testing, arbitrary file reads, and config extraction; CLI argument parsing for single-target or bulk scanning; threaded worker execution for mass scanning; result aggregation and JSON output. The README documents usage and expected output. This is not merely a detector: it actively retrieves arbitrary files from vulnerable targets, making it a real exploit-oriented scanner rather than a pure detection script.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-68645, targeting Zimbra installations prior to version 10.2. The main exploit script, 'CVE-2025-68645.py', is obfuscated and protected using PyArmor, making direct code analysis infeasible. However, documentation and metadata indicate that the script is intended for academic and defensive research, demonstrating the technical behavior and impact of the vulnerability in a controlled environment. The README and documentation files emphasize responsible use, legal compliance, and mitigation advice. The exploit is designed to be run on Python 2.7.14, preferably on Windows, but may be adaptable to other platforms. No hardcoded network endpoints, IPs, or domains are visible in the unobfuscated portions of the code. The repository includes licensing, notices, and mitigation documentation, as well as a screenshot directory. Overall, this is a research-focused PoC exploit for CVE-2025-68645 in Zimbra, with the main technical details hidden by code obfuscation.