CVE-2020-7796: Synacor Zimbra Collaboration Suite -- SSRF via WebEx Zimlet

Background

Zimbra Collaboration Suite (ZCS) is an open-source and enterprise email and groupware platform widely deployed across government, enterprise, and educational institutions. ZCS supports zimlets — plugin extensions that add functionality, including integration with third-party services like Cisco WebEx for meeting scheduling.

CVE-2020-7796 is a legacy vulnerability — originally disclosed in 2020 — that received renewed attention with CISA’s February 2026 KEV listing. This indicates active exploitation of unpatched Zimbra deployments more than five years after disclosure. The SSRF (CWE-918) vulnerability exists when the Cisco WebEx zimlet is installed and Zimbra’s zimlet JSP endpoint is enabled, allowing attackers to make server-side requests to internal network resources.

Zimbra servers are perennial targets for nation-state threat actors and ransomware groups. Multiple Zimbra vulnerabilities appear in CISA’s KEV catalog, reflecting the platform’s widespread deployment in high-value targets.

Technical Mechanism

CWE-918 (Server-Side Request Forgery) manifests in the WebEx zimlet when the zimlet’s JSP endpoint accepts a URL parameter and fetches it server-side to proxy WebEx content, without restricting requests to external/safe destinations.

# SSRF via WebEx zimlet endpoint
GET /zimbra/zimlet/com_zimbra_webex/httpPost.jsp?
    url=http://169.254.169.254/latest/meta-data/iam/security-credentials/role HTTP/1.1
Host: mail.victim.com

# Server fetches AWS metadata service and returns credentials in response

The zimlet’s proxy endpoint is accessible without authentication (or with minimal auth in some configurations) and forwards responses from the fetched URL back to the attacker, enabling extraction of internal resources.

Real-World Exploitation Evidence

The 2026-02-17 CISA KEV listing for a 2020 vulnerability confirms that organizations continue to run unpatched Zimbra installations. Zimbra is actively exploited by multiple threat actor groups. The SSRF in the WebEx zimlet is exploited to harvest cloud provider credentials from instance metadata services, probe internal network services, and exfiltrate data from internal Zimbra servers or connected LDAP/AD infrastructure. Zimbra-focused campaigns have been attributed to APT groups targeting government and critical infrastructure email.

Impact Assessment

• Server-side requests to internal network services from Zimbra’s network context
• Extraction of cloud provider credentials from metadata APIs
• Access to internal LDAP, Active Directory, and mail server configuration
• Network topology enumeration from Zimbra’s privileged internal position
• Potential for credential theft enabling broader enterprise compromise

Affected Versions

Remediation Steps

1. Upgrade Zimbra to a patched version addressing CVE-2020-7796.
2. Uninstall the Cisco WebEx zimlet if it is not actively used.
3. Disable zimlet JSP execution if not required.
4. Implement cloud metadata service IMDSv2 requirements to mitigate credential theft via SSRF.
5. Monitor Zimbra server outbound connections for requests to internal RFC-1918 addresses.
6. Apply network egress filtering on the Zimbra server to block unexpected internal destinations.

Detection Guidance

Log Sources: Zimbra access logs, network proxy/firewall logs, cloud provider CloudTrail/audit logs.

IOCs: Requests to the WebEx zimlet httpPost.jsp endpoint containing internal IP addresses or cloud metadata URLs; outbound HTTP from Zimbra server to 169.254.169.254 or RFC-1918 ranges.

Suricata rule:

alert http $HTTP_SERVERS any -> $HOME_NET any (
  msg:"ET WEB Zimbra WebEx Zimlet SSRF CVE-2020-7796";
  flow:established,to_client;
  content:"httpPost.jsp"; http_uri;
  content:"url="; http_uri;
  pcre:"/url=(https?:\/\/)(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/U";
  classtype:web-application-attack;
  sid:2099011; rev:1;
)

Timeline

References

• NVD — CVE-2020-7796
• CISA KEV — CVE-2020-7796
• MITRE CVE — CVE-2020-7796