ID:8601 - Exploit for Security features bypass in AMaViS - CVE-2022-41352

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insecure fall-back by amavis to using cpio to extract files if the pax package is not installed on the system. The amavisd extracts the contents of compressed attachments for virus scanning and uses cpio in an insecure manner. A remote attacker can send a specially crafted archive to the email system that once extracted can overwrite arbitrary files on the system.

Note, the vulnerability was used in the wild against misconfigured Zimbra Collaboration (ZCS) installations.

Remediation