Zimbra Collaboration Cross-Site Scripting Vulnerability in Webmail Briefcase Import

A cross-site scripting (XSS) vulnerability has been identified in Zimbra Collaboration (ZCS) versions through 10.1. This issue arises from inadequate validation of content type metadata when files are imported into the briefcase, allowing attackers to execute arbitrary JavaScript in the victim's session. The vulnerability can be exploited by crafting a file with manipulated metadata to bypass content type checks.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user.

Reproduction

To reproduce this vulnerability, import a file with altered metadata into the Zimbra webmail briefcase. The file should be crafted to exploit the lack of content type validation, enabling the execution of JavaScript in the user's session.

Remediation

Users can upgrade to ZCS versions 10.1.1, 10.0.9 Patch 41, or 8.8.15 Patch 46, all of which include the necessary fix.