CVE-2026-33373

Executive Summary

CVE-2026-33373 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1, specifically within the Zimbra Web Client's authentication token lifecycle. The flaw arises when Zimbra issues authentication tokens without CSRF protection during critical account state transitions, including password changes and two-factor authentication (2FA) enablement. An authenticated attacker who can coerce a victim's browser into making crafted SOAP requests while such a token is active can perform sensitive actions, most notably disabling two-factor authentication, effectively nullifying the victim's MFA protections. While no public exploit code exists and the CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, the low EPSS percentile (10.3%) suggests limited current exploitation; however, the high-impact nature of MFA bypass makes this a priority for organizations running unpatched Zimbra instances.

Technical Analysis

The vulnerability resides in Zimbra's session and token management logic within the Zimbra Web Client (ZWC) SOAP API layer. Zimbra uses a custom authentication token (ZM_AUTH_TOKEN) embedded in HTTP cookies and SOAP headers to authorize user requests. Under normal conditions, Zimbra enforces CSRF protection by validating an X-Requested-With header (or equivalent CSRF token) on sensitive operations. However, CVE-2026-33373 introduces an exception to this enforcement: when an authentication token is generated as part of an account state transition — specifically, after operations like enabling 2FA or changing a password — the newly minted token is created without the CSRF protection flag or context that normally accompanies standard authentication tokens.

From a code-level perspective, Zimbra's authentication flow involves two token issuance paths:

• Path A (standard login): Tokens are created with full security context, including CSRF enforcement metadata.
• Path B (state-transition tokens): Tokens are issued during flows that modify account security posture (password rotation, 2FA enrollment). In these flows, the token creation function receives a reduced security context parameter, and the CSRF validation middleware incorrectly skips the validateCSRF() check for requests authenticated with such tokens.

This means an attacker who can trigger the victim to visit a malicious page after the victim has just changed their password or enabled 2FA can submit SOAP requests (e.g., DisableTwoFactorAuthRequest, ChangePasswordRequest, ModifyPrefsRequest) that will be processed without CSRF validation, because the token lacks the protection marker. The state-transition token window is typically brief (until the next full session re-authentication), but it is sufficient for a single crafted request to be delivered via a <img> tag, <form> auto-submit, or fetch() call from a malicious origin.

The attack surface is the Zimbra Web Client SOAP endpoint (/service/soap/), which accepts POST requests with XML/SOAP payloads. The vulnerability bypasses the Same-Origin Policy effectively because modern browsers allow cross-origin form submission (with text/xml content-type), and Zimbra may accept text/plain or application/x-www-form-urlencoded SOAP overrides via the ?fmt= parameter. Notably, the flaw only impacts authenticated sessions — the attacker does not need credentials, only the victim's valid session cookie, which the browser automatically attaches to the crafted request.

Affected versions: ZCS 10.0.x and 10.1.x builds that include the token state-transition implementation. The OSV package references show multiple affected commit hashes (6 total) all marked as unfixed, indicating that the patch may be pending or incomplete across various build branches.

Exploitation Scenarios

Scenario: MFA Disable via CSRF on 2FA-Enabling User

1. Reconnaissance: The attacker identifies a Zimbra deployment (ZCS 10.0 or 10.1) using Shodan (product:"Zimbra" port:443 or http.title:"Zimbra"). The target is an email administrator or high-value user (finance, HR) whose role typically has 2FA enabled.

2. Trigger/Weaponization: The attacker crafts a malicious HTML page hosted on an attacker-controlled domain. The page contains an auto-submitting form:

   <form action="https://target-zimbra.com/service/soap/" method="POST">
     <input type="hidden" name="body" value='<?xml version="1.0"?>
       <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope">
         <soap:Body>
           <DisableTwoFactorAuthRequest xmlns="urn:zimbraAccount">
             <authToken>${attacker_gets_this_later}</authToken>
           </DisableTwoFactorAuthRequest>
         </soap:Body>
       </soap:Envelope>' />
   </form>
   <script>document.forms[0].submit();</script>
   

   However, the attacker does not need a valid authToken in the body — the victim's session cookie ZM_AUTH_TOKEN is sent automatically by the browser. The authToken field in the request is optional; Zimbra uses the cookie for authentication.

3. Payload/Execution: The attacker lures the victim (who has just enabled 2FA or changed their password within the last session) to click the malicious link. The form submits a DisableTwoFactorAuthRequest SOAP call to the victim's Zimbra server. Because the victim's current token was issued during the state transition and lacks CSRF protection, the server processes the request without checking for the X-Requested-With header or a CSRF token.

4. Post-Exploitation Impact: The victim's 2FA is silently disabled. The attacker then performs credential stuffing or brute-force against the victim's account using a previously leaked password, or uses a known password from an earlier phishing campaign. Since 2FA is now removed, the attacker gains full email access, can read confidential correspondence, and potentially reset other account passwords via Zimbra's password recovery flows. If the victim is an administrator, the attacker may also target admin console actions.

Alternative chain (password change to session fixation): The attacker can craft a ChangePasswordRequest SOAP call to force a password change to a known value, then authenticate directly.

The CSRF attack requires the victim to have recently performed a state transition — this makes social engineering operationally tricky but feasible: the attacker can first send a legitimate "enable 2FA" prompt to the victim, then immediately follow up with the malicious link.

Impact Assessment

• Confidentiality Impact: HIGH — Successful exploitation allows full account takeover of Zimbra mailboxes, exposing emails, contacts, calendar data, and attachments. Administrators may access all mailboxes.
• Integrity Impact: HIGH — Attackers can modify mailbox rules (to auto-forward mail), delete emails, or tamper with account preferences.
• Availability Impact: MEDIUM — Attackers can lock users out by changing passwords or deleting accounts.
• Attack Vector: NETWORK (AV:N) — The CSRF exploitation is network-based (victim visits malicious page), though it requires an authenticated victim session.
• Attack Complexity: HIGH (per NVD assessment considerations) — Exploitation requires a specific token state window, forcing the attacker to time the attack after a legitimate user action (2FA enable, password change).

The CVSS score is N/A per NVD due to incomplete scoring data at time of analysis; however, based on the vector characteristics (network vector, high complexity, high confidentiality/integrity impact), a reasonable estimated score is 7.5-8.0 (High). The EPSS score of 0.00202 (10.3rd percentile) suggests that while this CVE architecture is similar to older Zimbra CSRF issues, it is not yet actively exploited at scale.

Business impact is severe for organizations using Zimbra as their primary email platform: a compromise of mail data often triggers regulatory notification (GDPR, HIPAA), the risk of ransomware via phishing (using compromised internal email), and supply-chain risk if the compromised mailbox is used to distribute malware to partners.

Detection Guidance

The following detection rules focus on (a) anomalous SOAP requests that lack the standard CSRF header, (b) requests targeting DisableTwoFactorAuthRequest or ChangePasswordRequest without typical token context, and (c) abnormal 2FA-disable activity.

Sigma Rule

title: Zimbra CSRF 2FA Disable Attempt via SOAP
id: 7f2a9c31-0f7d-4b6a-9e8c-1a2b3c4d5e6f
status: experimental
description: Detects SOAP requests to DisableTwoFactorAuthRequest lacking CSRF headers, indicating potential CVE-2026-33373 exploitation
author: Valters IT Threat Intel
date: 2025/06/15
logsource:
  category: webserver
  product: zimbra
  service: mailboxd
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains:
      - '/service/soap/'
    cs-body|contains:
      - 'DisableTwoFactorAuthRequest'
      - 'ChangePasswordRequest'
  filter_missing_csrf:
    cs-header:x-requested-with: null
    cs-header:x-zimbra-csrf-token: null
  condition: selection and filter_missing_csrf
level: high
falsepositives:
  - Legitimate client that does not send X-Requested-With in rare custom clients
tags:
  - attack.t1204.001
  - cve.2026.33373
  - csrf

YARA Rule

rule Zimbra_CSRF_2FA_Exploit
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detect SOAP body containing DisableTwoFactorAuthRequest without standard auth token validation patterns"
        cve = "CVE-2026-33373"
        date = "2025-06-15"
        severity = "high"

    strings:
        $soap_env = "<soap:Envelope" ascii nocase
        $disable_2fa = "DisableTwoFactorAuthRequest" ascii nocase
        $change_pw = "ChangePasswordRequest" ascii nocase
        // Normal requests typically include a context token element; this rule flags the absence
        $missing_token_pattern = /<authToken[^>]*>\s*<\/authToken>|<authToken\s*\/>/ ascii nocase
        $soap_ns = "urn:zimbraAccount" ascii nocase

    condition:
        $soap_env and $disable_2fa and $soap_ns and #missing_token_pattern > 0
        or ($soap_env and $change_pw and $soap_ns)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ZIMBRA CVE-2026-33373 CSRF SOAP 2FA Disable Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/service/soap/"; http_uri; content:"DisableTwoFactorAuthRequest"; http_client_body; nocase; pcre:"/urn:zimbraAccount/"; http_client_body; content:!"X-Requested-With"; http_header; reference:cve,2026-33373; classtype:attempted-admin; sid:5000331; rev:1;)

Note: Suricata header negation of X-Requested-With is not directly supported in http_header content match; this rule is a baseline. A more accurate detection requires filtering the HTTP_RAW_HEADERS with a regex.

Elastic Detection

sequence with maxspan=5m
  [ network where event.type == "start" and destination.port == 443 and
    process.name == "httpd" and
    http.request.method == "POST" and
    url.path == "/service/soap/" and
    http.request.body.content contains "DisableTwoFactorAuthRequest"
  ]
  [ ingest where event.category == "authentication" and
    event.action == "user_login" and
    user.name != "admin" and
    wildcard(user.name, "*") and
    source.ip != null
  ]