SSRF in Zimbra Collaboration Suite ProxyServlet

This repository contains two main exploit implementations for CVE-2019-9621 and CVE-2019-9670, targeting Zimbra Collaboration Suite versions 8.5 to 8.7.11 (potentially up to <8.8.11). The exploits leverage an XXE vulnerability in the Autodiscover servlet to extract sensitive configuration (including LDAP credentials), then use those credentials to authenticate and escalate privileges via SSRF to the admin interface. Finally, a JSP webshell is uploaded to the server, granting remote code execution. The repository includes: - Zimbra_Rce.py: A standalone Python script that automates the full exploit chain, from XXE to webshell upload and access. - Zimbra_msf.rb: A Metasploit module implementing the same attack chain, allowing for customizable payloads and integration with the Metasploit framework. - zimbra.dtd: A DTD file used in the XXE attack to extract sensitive configuration files. - README.md: Brief documentation and references. The main attack vector is network-based, requiring access to the Zimbra web interface. The exploit is weaponized, with both standalone and framework-based implementations, and results in remote code execution on the target server. Multiple HTTP endpoints are targeted throughout the attack chain, and the exploit is highly effective against vulnerable Zimbra installations.