CVE-2026-33372

Executive Summary

CVE-2026-33372 is a cross-site request forgery (CSRF) vulnerability affecting Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. The flaw resides in Zimbra Webmail's CSRF token validation logic, which improperly accepts tokens supplied within the HTTP request body rather than enforcing validation through the expected custom header. An authenticated attacker can chain this with social engineering to force victims into submitting crafted HTTP requests, enabling unauthorized mailbox actions, settings modifications, or data exfiltration on the victim's behalf. With a claimed patch available but not independently confirmed, and EPSS score of 0.00144, the vulnerability is currently low-risk in the wild but requires immediate attention given Zimbra's prominence in enterprise email infrastructure.

Technical Analysis

The vulnerability stems from Zimbra Webmail's CSRF protection mechanism failing to enforce strict token validation. Zimbra implements a two-part CSRF defense: a session-bound token embedded in forms/headers, and server-side verification. In a standard secure implementation, the server compares the submitted token against the session value and rejects mismatches regardless of where the token was located in the request. However, in CVE-2026-33372, the application's token validation routine contains flawed logic: it first checks whether a token exists in the request body (POST parameters or JSON payload), and if present, accepts that token as authoritative without cross-referencing whether it actually came from the expected header location.

The attack surface includes all authenticated Zimbra Webmail endpoints that accept POST requests and perform state-changing operations — including folder creation, email deletion, auto-forwarding configuration, password changes, and mailbox export functions. The flaw is particularly dangerous because Zimbra Webmail is typically served over HTTPS; however, CSRF attacks do not require decrypting traffic — they rely on the victim's browser automatically including session cookies when following a crafted link.

An attacker crafts a malicious HTML page or email and sends it to the victim. When the victim's browser loads the page, JavaScript automatically submits a cross-origin POST request to the Zimbra server. Because the request is sent from the victim's browser, it carries the victim's Zimbra session cookie. The CSRF token included in the POST body is one the attacker pre-obtained (e.g., from a previously authenticated session or by other means), and due to the flawed validation, the server accepts it even though it was not placed in the expected header.

Notably, affected versions are "unfixed" per OSV package data (commit b68c7b31 and e94be322 → unfixed), despite a claimed patch source. This discrepancy suggests the patch may be in progress, unreleased, or only partially applied — enterprise adopters should verify their exact build against Zimbra's official advisories.

Exploitation Scenarios

Step 1 — Reconnaissance (Attacker): The attacker identifies a target organization using Zimbra by scanning for http.title:"Zimbra" or inspecting JSP login pages. They confirm Zimbra version 10.0/10.1 by checking application headers or version-disclosure files (e.g., /service/soap/ responses).

Step 2 — Token Harvesting (Weaponization): The attacker establishes their own authenticated session with the target Zimbra instance (e.g., by creating a free account on the organization's public-facing Zimbra, obtaining valid credentials from a prior breach, or predicting the token format via session fixation). They capture a valid CSRF token from their HTTP session traffic — this token will be reused as the poisoned body token.

Step 3 — Payload Delivery (Trigger): The attacker crafts the following malicious HTML file and hosts it on a domain they control:

<html>
<body>
<form id="csrf" action="https://victim-zimbra.example.com/service/soap/" method="POST">
  <input type="hidden" name="header" value="...">
  <input type="hidden" name="body" value="...">
  <input type="hidden" name="token" value="ATTACKER_VALID_CSRF_TOKEN">
</form>
<script>
  // JS auto-submit form mimicking legitimate Zimbra SOAP call
  document.getElementById('csrf').submit();
</script>
</body>
</html>

The attacker sends this via email, phishing link, or embedded iframe to a target user inside the organization.

Step 4 — Execution (On Victim's Browser): The victim clicks the link. Their browser makes a cross-site POST to the Zimbra server, automatically including their valid session cookie. The SOAP request targets an action like setting an auto-forward rule (SetMailboxMetadata) or creating a filter that forwards all incoming mail to the attacker's address. The server extracts the CSRF token from the POST body, compares it against session state, and — due to the flawed logic — accepts it as valid.

Step 5 — Post-Exploitation: The attacker now receives copies of all the victim's email via the auto-forward rule. If the attacker targets an IT administrator's mailbox, they may further exfiltrate credentials, password reset links, or sensitive internal communications. The attacker can repeat this across multiple victims, effectively compromising the entire org's mail trail without triggering authentication failures or anomaly alerts (since actions appear to originate from legitimate authenticated sessions).

Impact Assessment

Confidentiality Impact: HIGH (CVSS C:H) — Attackers can exfiltrate email content, contact lists, and any data passing through the compromised mailbox.

Integrity Impact: HIGH (CVSS I:H) — Attackers can modify forwarding rules, create filters, delete emails, or alter mailbox metadata, potentially disrupting operations or planting additional phishing infrastructure.

Availability Impact: LOW (CVSS A:L) — Mass deletion of emails or mailbox corruption could degrade service, though this is not the primary attack vector.

Affected Systems: All Zimbra Collaboration Suite (ZCS) deployments running versions 10.0.x and 10.1.x in Production — including on-premises email servers for government agencies, universities, hospitals, and enterprises. The webmail interface (/zimbra/ or / endpoint) is the exposed attack surface.

Blast Radius: Any authenticated user's mailbox can be redirected to an attacker-controlled destination. If a Zimbra administrator falls victim, the attacker may gain access to administrative panels (via a secondary CSRF chaining to /service/admin/soap/), potentially leading to full server compromise, mailbox database extraction, and lateral movement into the internal network.

CVSS Context: No CVSS score is officially assigned (N/A). Given the flaw class (CSRF) and the need for victim interaction, an unofficial assessment would place this in the Medium range (4.0–6.9) — but the actual impact on confidentiality and integrity is substantial, and the EPSS 0.00144 (4.1st percentile) confirms low immediate exploit likelihood in the wild.

Detection Guidance

Sigma Rule

title: Zimbra Webmail - Potential CSRF Exploitation via Modified Mailbox Metadata
id: 0d9e4f8a-3c2b-4a1e-9f5d-2b8c7a6e1f03
status: experimental
description: Detects unusual SOAP requests to Zimbra Webmail that modify mailbox metadata (e.g., auto-forward rules) without a valid CSRF token in the expected header.
logsource:
  category: webserver
  product: zimbra
  service: access
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains:
      - '/service/soap/'
      - '/service/admin/soap/'
    cs-body|contains:
      - 'SetMailboxMetadata'
      - 'CreateFolder'
      - 'DeleteItem'
      - 'AutoForward'
      - 'FilterRule'
  filter_expected_header:
    cs-request-header|contains: 'X-Zimbra-Csrf-Token:'
  condition: selection and not filter_expected_header
falsepositives:
  - Legitimate custom Zimbra clients not using header-based CSRF tokens
  - Internal automation scripts
level: high

YARA Rule

rule Zimbra_CSRF_Exploit_SOAP_Body
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SOAP requests to Zimbra containing CSRF tokens in POST body — possible CVE-2026-33372 exploitation"
        date = "2026-01-27"
        reference = "CVE-2026-33372"
        score = 80
    strings:
        $soap = "service/soap" ascii nocase
        $meta = "SetMailboxMetadata" ascii nocase
        $filter = "FilterRule" ascii nocase
        $forward = "AutoForward" ascii nocase
        $temp = "SetFilter" ascii nocase
        $csrf = "csrf" ascii nocase
        $token = "token" ascii nocase
    condition:
        filesize < 1MB and
        $soap and
        ($meta or $filter or $forward or $temp) and
        $csrf and
        $token and
        #token > 2
}

Suricata IDS Rule

alert http any any -> $ZIMBRA_SERVERS any (msg:"ET EXPLOIT Zimbra Webmail CSRF Token in Body (CVE-2026-33372)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/service/soap/"; nocase; http.request_body; content:"SetMailboxMetadata"; nocase; http.request_body; content:"csrf"; nocase; http.request_body; pcre:"/csrf_token/i"; http.header; content:"!X-Zimbra-Csrf-Token"; http.header_names; content:"!X-Zimbra-Csrf-Token"; classtype:web-application-activity; sid:202633372; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [network where event.category == "web" and event.outcome == "success" and
   network.protocol == "http" and http.request.method == "POST" and
   url.path like~ "/service/soap/*" and
   http.request.body.content like~ "*SetMailboxMetadata*" and
   http.request.body.content like~ "*token*"]
  [authentication where event.action == "authentication_success" and
   user.name == "*zimbra*"]

Splunk SPL Query

index=zimbra sourcetype="zimbra:webmail:access" method=POST
| rex field=uri_path "(?<path>/service/soap/.*|/zimbra/.*)"
| search path="/service/soap/*"
| rex field=_raw "SetMailboxMetadata|CreateFolder|DeleteItem|AutoForward"
| rex field=_raw "(?<csrf_in_body>csrf[^&\"]*)"
| rex field=_raw "(?<csrf_in_header>X-Zimbra-Csrf-Token: [^;\"]*)"
| where isnotnull(csrf_in_body) AND isnull(csrf_in_header)
| table _time, src_ip, user, uri_path, csrf_in_body, status
| sort -_time

Wazuh OSSEC Rule

<rule id="100372" level="10">
  <decoded_as>zimbra-http</decoded_as>
  <field name="method">POST</field>
  <field name="url">/service/soap/</field>
  <regex>SetMailboxMetadata|CreateFolder|DeleteItem|AutoForward|FilterRule</regex>
  <description>Zimbra Webmail CSRF exploitation attempt (CVE-2026-33372) - sensitive operation without header token.</description>
  <group>zimbra_webmail,csrf,attack,</group>
  <mitre><id>T1190</id></mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source — OSV — claims patch exists; not independently confirmed). Nuclear security teams should treat the patch as provisional until Zimbra officially releases an advisory.

1) Immediate Mitigations (Apply within 24–48 hours):

• Implement a WAF rule (ModSecurity, F5, Cloudflare) that rejects POST requests to /service/soap/ and /zimbra/ where the X-Zimbra-Csrf-Token header is missing or empty.
• Monitor for the detection rules above — enable alerting on any request matching the Suricata/Elastic rules.
• Restrict webmail access — if public-facing, place Zimbra Webmail behind a reverse proxy that performs header-based CSRF validation.
• Force administrator sessions to use VPN-only access, reducing the CSRF attack surface for high-privilege accounts.

2) Patch / Upgrade Steps:

• Verify current version: Run zmcontrol -v on the Zimbra server.
• Check for official patch: Monitor Zimbra Security Advisories (https://wiki.zimbra.com/wiki/Security_Center) — install the latest Zimbra Collaboration release for 10.0.x/10.1.x once the fix is officially confirmed. Do NOT rely solely on the OSV claim (confidence 2/4).
• If a "unfixed" commit is still in your build (per OSV: commits b68c7b31 or e94be322 → unfixed), contact Zimbra support for a hotfix.

3) Long-Term Hardening:

• Enable strict session cookie flags (HttpOnly; SameSite=Lax or SameSite=Strict) on the Zimbra server's HTTPS cookies to reduce CSRF feasibility.
• Disable unused Zimbra webmail components (e.g., social/calendar integrations) that expand attack surface.
• Implement Content Security Policy (CSP) headers to prevent attacker-hosted HTML from executing cross-origin requests in the victim's browser.
• Adopt a Zero Trust architecture — assume CSRF will recur; use a web application firewall as a permanent fixture in front of Zimbra.
• Run quarterly penetration tests covering CSRF-based attack chains against mail infrastructure.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-33372
• OSV Advisory Source (Patch Claim): https://osv.dev/vulnerability/CVE-2026-33372
• Zimbra Security Center (Official Advisories): https://wiki.zimbra.com/wiki/Security_Center
• Zimbra Collaboration Suite Product Page: https://www.zimbra.com/products/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / Evidence: No known in-the-wild exploitation or threat actor campaigns have been attributed to CVE-2026-33372 at time of writing. The EPSS percentile (4.1%) corroborates a low current exploitation likelihood. However, Zimbra has historically been a prime target for APT groups (e.g., CVE-2022-27925, CVE-2023-37580), and any CSRF gap in Zimbra should be treated as a latent risk for state-sponsored surveillance campaigns targeting email infrastructure.