Description

An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-25T14:17:23.673Z",
  "pubdate": "2026-09-25T14:17:23.673Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified in Zimbra Classic.\nThe issue arises due to the improper neutralization of malicious markup injected into the 'From' field of an iCalendar COUNTER message.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript within the security context of the victim's browser session.\nThe primary impact includes unauthorized access to sensitive mailbox data, session hijacking, and the potential for the attacker to perform actions on behalf of the victim.\nThe vulnerability requires no prior authentication, as the attack vector is delivered through standard email/calendar synchronization channels.\nThe risk is critical, as it compromises the confidentiality and integrity of the user's webmail session, potentially leading to full account takeover through CSRF or session token theft.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the Zimbra Classic front-end rendering engine to perform adequate input sanitization on specific fields within iCalendar (RFC 5545) messages.\nSpecifically, the 'From' address field in a COUNTER message type is processed and rendered by the application without sufficient output encoding or HTML entity escaping.\nAn unauthenticated attacker can craft a malicious calendar request containing an 'RFC From' header populated with active HTML tags or JavaScript URI schemes (e.g., <img src=x onerror=...>).\nWhen a victim opens or selects the compromised message within the Zimbra Classic web interface, the client-side rendering logic inserts the unescaped malicious payload directly into the Document Object Model (DOM).\nBecause this occurs in the context of the authenticated user's session, the injected script executes with the same privileges as the victim's session.\nThe attack flow follows these steps: 1. The attacker sends a crafted COUNTER message to the victim's mailbox. 2. The Zimbra server accepts the message as a legitimate calendar entity. 3. The victim interacts with the Zimbra Classic interface, triggering the rendering of the calendar item. 4. The browser interprets the malicious markup within the 'From' header field. 5. The arbitrary JavaScript executes.\nThe impact of successful code execution is severe. Since the script resides in the same origin as the Zimbra application, it can bypass the Same-Origin Policy (SOP).\nThis allows the attacker to read the contents of the victim's inbox, exfiltrate private messages, manage calendar events, or exfiltrate session cookies if the HttpOnly flag is not properly implemented or if the script utilizes other mechanisms to interact with the DOM.\nThe lack of authentication requirements makes this a highly accessible vector for external threat actors, provided they can successfully route an email message to the target Zimbra server.\nThis vulnerability highlights a critical failure in the sanitization of user-controllable input originating from outside the application trust boundary, specifically within the parsing of complex calendar data types."
}