XXE in Synacor Zimbra Collaboration Suite mailboxd Autodiscover

This repository contains a Python exploit script (zimbra.py) targeting Zimbra Collaboration Suite versions <= 8.7.0 and 8.7.11, exploiting CVE-2019-9670. The exploit leverages an XXE vulnerability in the Autodiscover servlet to extract low-privilege credentials, then uses SSRF via the ProxyServlet to escalate to admin privileges. With the admin token, it uploads an arbitrary file (such as a web shell) to the server, enabling remote code execution. The script requires the attacker to provide a target URL, a DTD file URL (for the XXE payload), a payload file, and a name for the uploaded file. The main code file is zimbra.py, which implements the full exploit chain. The README provides usage instructions and context. No framework is used; this is a standalone operational exploit.

This repository contains a Python exploit script (zimbra.py) targeting Zimbra Collaboration Suite versions <= 8.7.0 and 8.7.11, exploiting CVE-2019-9670. The exploit leverages an XXE vulnerability in the Autodiscover servlet to extract low-privilege credentials, then uses SSRF via the ProxyServlet to escalate privileges and obtain an admin token. With this token, it uploads an attacker-supplied file (such as a web shell) to the server using the clientUploader endpoint. The exploit is operational and requires the attacker to provide a DTD payload hosted at a reachable URL, the target Zimbra instance URL, and a file to upload. The README provides usage instructions and argument details. The main code is in zimbra.py, with LICENSE and README.md as supporting files. The exploit is not part of a framework and is a standalone operational exploit for remote code execution on vulnerable Zimbra servers.