Description

In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with the generated secret may be able to recover the JWT signing secret through offline brute-force, potentially enabling JWT forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T16:19:06.923Z",
  "pubdate": "2026-08-13T16:19:06.923Z",
  "executiveSummary": "A weak cryptographic key generation vulnerability exists within the OnlyOffice integration of Zimbra Collaboration (ZCS) before version 10.1.17. The flaw arises from the utilization of an insecure random number generator to produce the zimbraDocumentEditingJwtSecret, yielding insufficient entropy in the resulting cryptographic material. This structural deficiency compromises the integrity of JSON Web Tokens (JWT) utilized within the document editing subsystem.\nThe primary impact of this vulnerability is the potential for cryptographic compromise. An adversary capable of acquiring a legitimate JWT signed with the insecurely generated secret can subject the token to offline brute-force attacks to systematically recover the underlying signing secret. Once the secret is successfully recovered, the attacker gains the ability to forge arbitrary JWTs, potentially leading to unauthorized access and privilege escalation within the context of the OnlyOffice integration.\nThe affected product is Zimbra Collaboration (ZCS) versions prior to 10.1.17, specifically impacting deployments leveraging the OnlyOffice integration feature. Exploitation requires the attacker to obtain at least one valid JWT issued by the system in order to execute the offline brute-force attack against the low-entropy signing secret. No specialized privileges or authentication are initially required to capture transit or otherwise accessible tokens, provided the attacker can observe a legitimate interaction with the document editing service.",
  "technicalDetails": "The root cause of the vulnerability lies in the cryptographic implementation of the key generation routine for the zimbraDocumentEditingJwtSecret within the OnlyOffice integration component of Zimbra Collaboration (ZCS) before version 10.1.17. Rather than utilizing a cryptographically secure pseudorandom number generator (CSPRNG) that draws from sufficient system entropy, the application employs an insecure random number generation mechanism. This severely restricts the keyspace and predictability of the generated secret, introducing a critical cryptographic weakness.\nThe vulnerable component is the secret generation module responsible for establishing the shared secret used in HMAC-based or similar JWT signature algorithms within the OnlyOffice document editing integration. Because the resulting secret lacks adequate entropy, the keyspace is small enough to render computational exhaustion feasible via modern hardware resources.\nThe attack flow proceeds in a structured sequence. First, the attacker intercepts or otherwise obtains a valid JSON Web Token (JWT) generated by the Zimbra Collaboration (ZCS) environment during normal usage of the OnlyOffice integration. This token contains a cryptographic signature produced using the weak zimbraDocumentEditingJwtSecret. Second, the attacker extracts the payload, header, and signature from the intercepted JWT. Third, leveraging the knowledge that the signing secret was derived from an insecure random number generator with low entropy, the attacker initiates an offline brute-force or dictionary-based cracking process against the signature. Fourth, by iterating through the constrained keyspace defined by the weak generation algorithm, the attacker computes candidate signatures until a match is found, thereby recovering the exact zimbraDocumentEditingJwtSecret.\nFollowing the successful recovery of the signing secret, the post-exploitation impact is severe. The attacker possesses the capability to forge arbitrary JWTs with arbitrary claims and elevated privileges accepted by the OnlyOffice integration and associated Zimbra Collaboration (ZCS) services. This enables unauthorized interactions, potential session hijacking, and manipulation of document editing sessions without requiring legitimate credentials or prior system access beyond the initial token acquisition and offline cracking phase."
}