CVE-2017-20191

Root

Cause

The vulnerability resides in the function XFormItem.prototype.setError within the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The method directly assigns user-supplied input (message) to container.innerHTML without sanitization [2]. This means an attacker can control the error message shown on a form textbox, enabling cross-site scripting (XSS) [2].

Exploitation

To exploit this flaw, an attacker must craft a special request that triggers an error condition on a textbox field while passing a malicious payload in the message argument. No authentication is required if the affected component is exposed, as the attack can be initiated remotely [1]. Up to version 8.8.1, the error handler does not HTML-encode the message, allowing arbitrary script injection.

Impact

A successful exploit allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to data theft, session hijacking, or further malicious actions within the Zimbra admin interface.

Mitigation

The issue is fixed in version 8.8.2, where the commit bb240ce0c71c01caabaa43eed30c78ba8d7d3591 replaces the vulnerable assignment with AjxStringUtil.htmlEncode(message) [1][2]. Users are strongly advised to upgrade to version 8.8.2 or later to eliminate the XSS vector.