CVE-2022-24682

What is Zimbra Collaboration Suite?

Zimbra Collaboration Suite (ZCS) is an enterprise email, calendar, and collaboration platform used by government agencies, military organisations, academic institutions, and enterprises globally. Its Classic Web Client renders HTML email content and ICS calendar data directly in the user's browser — processing content from untrusted external senders in the context of an authenticated user session. Any JavaScript that executes in this context has full access to the session's authentication tokens, email archive, contacts, and calendar data.

CVE-2022-24682 is the first XSS vulnerability in the CISA Known Exploited Vulnerabilities catalog for Zimbra's Classic UI — the beginning of a pattern in which the same architectural weakness was exploited by different threat actors year after year through 2026.

Overview

CVE-2022-24682 is a stored cross-site scripting (XSS) vulnerability in the Calendar feature of Zimbra Collaboration Suite 8.8.x. The Classic Web Client fails to properly escape HTML placed inside calendar element attributes — allowing an attacker to inject arbitrary JavaScript into the calendar, which executes when a victim opens or previews the calendar item in their authenticated Zimbra session.

Affected Versions

Technical Details

The vulnerability exists in the Calendar feature of the Zimbra Classic Web Client. When Zimbra processes and renders calendar event data, user-supplied content embedded within HTML element attributes is not properly encoded before being inserted into the document. The HTML markup containing the attacker's payload becomes unescaped, injecting arbitrary HTML — including executable JavaScript — into the page.

Attack characteristics:

• Authentication required: No — the malicious calendar item can be sent by any external email sender
• User interaction: Required — victim must open or preview the calendar item in the Classic Web Client
• Execution context: Authenticated Zimbra session — attacker's script has access to the session's cookies, email data, and contacts

The attack delivers a malicious calendar invitation to the victim's Zimbra inbox. When the victim opens or previews the item in the Classic Web Client, the injected JavaScript executes. Observed post-exploitation actions include theft of session cookies, email contents, and attachments.

Discovery

CVE-2022-24682 was reported to Zimbra by Volexity researchers on February 3, 2022. Zimbra issued a fix the following day — February 4, 2022 — and CISA added the CVE to the KEV catalog three weeks later on February 25. The NVD notes that exploitation was observed in the wild starting December 2021, approximately six weeks before the vulnerability was formally reported, indicating a zero-day exploitation window.

Exploitation Context

CVE-2022-24682 was one of several Zimbra CVEs actively exploited in early-to-mid 2022, documented in CISA/MS-ISAC advisory AA22-228A. The advisory notes that malicious actors were exploiting the vulnerability to steal Zimbra session cookie files — providing persistent authenticated access to victims' webmail without requiring their passwords.

CISA's ransomware flag indicates that CVE-2022-24682 was exploited not only for intelligence collection but as an initial access vector in ransomware operations — consistent with the pattern across the broader Zimbra KEV cluster, where the same webmail exposure attracted both state-sponsored intelligence actors and opportunistic financially motivated attackers.

Remediation

1. Upgrade to ZCS 8.8.15 Patch 30 (Update 1) or later. The fix escapes HTML element attributes in calendar event rendering, preventing injection.
2. Review session activity for users whose accounts may have received calendar invitations from external senders during the December 2021–February 2022 exposure window. Look for unexpected authenticated API calls, email forwarding rules created, or bulk email access.
3. Invalidate active sessions for potentially affected users to force re-authentication after patching, removing any stolen but still-valid session cookies.
4. Monitor for ICS/calendar invitation delivery from unknown external senders as an ongoing detection signal for calendar-based XSS attacks.