{"id":4485,"date":"2022-10-16T05:57:00","date_gmt":"2022-10-16T03:57:00","guid":{"rendered":"https:\/\/fr.koddos.net\/blog\/?p=4485"},"modified":"2022-10-17T18:00:21","modified_gmt":"2022-10-17T16:00:21","slug":"pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day","status":"publish","type":"post","link":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/","title":{"rendered":"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY"},"content":{"rendered":"\n

La soci\u00e9t\u00e9 de cybers\u00e9curit\u00e9 Kaspersky a r\u00e9v\u00e9l\u00e9, dans un tweet<\/a><\/strong>, que 876 serveurs ont \u00e9t\u00e9 compromis dans le cadre d’une vuln\u00e9rabilit\u00e9 critique de Zimbra Collaboration Suite (ZCS). Au moment du piratage, la vuln\u00e9rabilit\u00e9 \u00e9tait qualifi\u00e9e de zero-day sans correctif depuis plus d’un mois.<\/p>\n\n\n\n

La vuln\u00e9rabilit\u00e9 est une faille d’ex\u00e9cution de code \u00e0 distance r\u00e9pertori\u00e9e sous le nom de CVE-2022-41352. Selon les chercheurs de la soci\u00e9t\u00e9 de s\u00e9curit\u00e9, la faille permet aux acteurs de la menace d’envoyer un e-mail avec une pi\u00e8ce jointe archive. Celle-ci enregistre un shell web dans le serveur ZCS tout en \u00e9chappant aux contr\u00f4les antivirus.<\/p>\n\n\n\n

Kaspersky a \u00e9galement r\u00e9v\u00e9l\u00e9 que divers groupes de menaces persistantes avanc\u00e9es (APT) ont exploit\u00e9 la vuln\u00e9rabilit\u00e9 peu apr\u00e8s qu’elle ait \u00e9t\u00e9 signal\u00e9e sur les forums Zimbra.<\/p>\n\n\n\n

La soci\u00e9t\u00e9 de cybers\u00e9curit\u00e9 a d\u00e9clar\u00e9 que les 876 serveurs \u00e9taient infiltr\u00e9s par des hackers sophistiqu\u00e9s avant que la vuln\u00e9rabilit\u00e9 ne re\u00e7oive un identifiant CVE et ne soit largement m\u00e9diatis\u00e9e.<\/p>\n\n\n\n

Une exploitation active des failles dans Zimbra Collaboration Suite<\/strong><\/p>\n\n\n\n

Dans un rapport publi\u00e9 par Rapid7 la semaine derni\u00e8re, la soci\u00e9t\u00e9 a annonc\u00e9 l’exploitation active publique de Zimbra Collaboration Suite (ZCS), un client web et serveur de messagerie populaire, rep\u00e9r\u00e9e sous le nom de CVE-2022-41352. Le zero-day, avec un score critique de 9,8, permet aux acteurs de la menace de t\u00e9l\u00e9charger des fichiers arbitraires via le syst\u00e8me de s\u00e9curit\u00e9 de messagerie \u00ab\u00a0Amavis\u00a0\u00bb.<\/p>\n\n\n\n

Si les hackers parviennent \u00e0 exploiter cette vuln\u00e9rabilit\u00e9, ils pourront \u00e9craser le webroot de Zimbra, acc\u00e9der aux comptes d’autres utilisateurs et installer un shellcode. Le bug a \u00e9t\u00e9 d\u00e9couvert d\u00e9but septembre sous la forme d’un zero-day apr\u00e8s que des administrateurs ont publi\u00e9 des d\u00e9tails sur les attaques sur les forums de Zimbra.<\/p>\n\n\n\n

Selon le rapport, le bug est d\u00fb \u00e0 une utilisation non s\u00e9curis\u00e9e du fichier \u00ab\u00a0cpio\u00a0\u00bb. Il comporte une faille qui permet aux attaquants de cr\u00e9er des archives \u00e0 partir de n’importe quel syst\u00e8me de fichiers accessible \u00e0 Zimbra.<\/p>\n\n\n\n

Zimbra a d\u00e9j\u00e0 publi\u00e9 un correctif de s\u00e9curit\u00e9 pour cette faille le 14 septembre et a conseill\u00e9 aux administrateurs de red\u00e9marrer leurs serveurs Zimbra apr\u00e8s avoir install\u00e9 un utilitaire d’archivage portable pour remplacer cpio, la pi\u00e8ce d\u00e9fectueuse.<\/p>\n\n\n\n

La soci\u00e9t\u00e9 indique qu’aucune configuration suppl\u00e9mentaire n’est n\u00e9cessaire puisque l’installation de Paxwill suffira \u00e0 r\u00e9soudre le probl\u00e8me. L’exploitation<\/a><\/strong> comprend \u00e9galement un exploit PoC qui permet aux acteurs de la menace de cr\u00e9er des archives malveillantes en toute simplicit\u00e9.<\/p>\n\n\n\n

De plus, Rapid7 a r\u00e9v\u00e9l\u00e9 un test r\u00e9cent qu’elle a effectu\u00e9, qui a montr\u00e9 que la plupart des distributions Linux support\u00e9es par Zimbra n’installent pas Pax par d\u00e9faut. Ceci constitue un probl\u00e8me suppl\u00e9mentaire car les serveurs restent tr\u00e8s vuln\u00e9rables aux attaques.<\/p>\n\n\n\n

\u00c0 l’\u00e9poque, Zimbra avait exhort\u00e9 les administrateurs \u00e0 prendre les pr\u00e9cautions n\u00e9cessaires puisqu’aucun patch n’\u00e9tait disponible pour cette vuln\u00e9rabilit\u00e9<\/a><\/strong>.<\/p>\n\n\n\n

Un correctif de s\u00e9curit\u00e9 pour la version 9.0.0 de ZCS a \u00e9t\u00e9 lanc\u00e9<\/strong><\/p>\n\n\n\n

Zimbra a d\u00e9clar\u00e9 avoir fourni un correctif de s\u00e9curit\u00e9 pour la faille P27 de la version 9.0.0 de ZCS. Celui-ci a supprim\u00e9 la partie vuln\u00e9rable qui rendait l’exploitation possible apr\u00e8s le remplacement du composant d\u00e9fectueux (cpio) par Pax. Mais avant que le correctif ne soit publi\u00e9, l’exploitation s’est rapidement d\u00e9velopp\u00e9e, plusieurs hackers ayant lanc\u00e9 des attaques opportunistes.<\/p>\n\n\n\n

Hier, Volexity a signal\u00e9 que 1 600 serveurs ZCS ont \u00e9t\u00e9 identifi\u00e9s par ses analystes qui pensent qu’ils ont \u00e9t\u00e9 exploit\u00e9s par des hackers qui ont tir\u00e9 parti de CVE-2022-41352 pour implanter des webshells.<\/p>\n\n\n\n

Kaspersky affirme \u00e9galement qu’un groupe de hackers<\/a><\/strong> inconnu tire profit de la vuln\u00e9rabilit\u00e9, sur la base des d\u00e9tails publi\u00e9s sur les forums Zimbra. L’entreprise de s\u00e9curit\u00e9 estime que les m\u00e9thodes op\u00e9rationnelles du groupe de hackers montrent qu’elles sont le fait d’un groupe APT sophistiqu\u00e9 disposant d’outils avanc\u00e9s pour leurs attaques.<\/p>\n\n\n\n

Le m\u00eame jour, Metasploit a ajout\u00e9 une preuve de concept (PoC), qui a permis \u00e0 des attaquants m\u00eame inexp\u00e9riment\u00e9s de lancer avec succ\u00e8s des attaques contre des serveurs sensibles.<\/p>\n\n\n\n

Il a \u00e9t\u00e9 conseill\u00e9 aux administrateurs d’appliquer rapidement les mises \u00e0 jour<\/strong><\/p>\n\n\n\n

Les premi\u00e8res attaques, qui ont d\u00e9but\u00e9 le mois dernier, visaient certains serveurs Zimbra en Turquie et en Inde. Mais ces premi\u00e8res vagues d’attaques visaient vraisemblablement des organisations plus petites comme terrain d’essai pour une attaque plus avanc\u00e9e. L’id\u00e9e \u00e9tait d’\u00e9valuer l’efficacit\u00e9 de l’attaque avant de passer aux actions. Et la premi\u00e8re vague d’attaque de test, selon Kaspersky, a compromis 44 serveurs.<\/p>\n\n\n\n

Apr\u00e8s la d\u00e9couverte et l’annonce de la vuln\u00e9rabilit\u00e9 au public, le groupe de hackers a intensifi\u00e9 son jeu et a commenc\u00e9 \u00e0 effectuer un ciblage de masse. Ils esp\u00e9raient infiltrer autant de serveurs que possible avant que les administrateurs ne fournissent un correctif et bloquent le passage des hackers.<\/p>\n\n\n\n

La deuxi\u00e8me vague a \u00e9t\u00e9 plus d\u00e9vastatrice, puisqu’elle a compromis 832 serveurs et implant\u00e9 des webshells malveillants. Mais cette fois, les attaques n’\u00e9taient pas aussi sp\u00e9cifiques que celles de la vague pr\u00e9c\u00e9dente.<\/p>\n\n\n\n

Zimbra a conseill\u00e9 aux administrateurs d’appliquer rapidement les correctifs \u00e0 la vuln\u00e9rabilit\u00e9 car les hackers ont continu\u00e9 \u00e0 exploiter des serveurs qui n’ont pas encore \u00e9t\u00e9 mis \u00e0 jour.<\/p>\n","protected":false},"excerpt":{"rendered":"

La soci\u00e9t\u00e9 de cybers\u00e9curit\u00e9 Kaspersky a r\u00e9v\u00e9l\u00e9, dans un tweet, que 876 serveurs ont \u00e9t\u00e9 compromis dans le cadre d’une vuln\u00e9rabilit\u00e9 critique de Zimbra Collaboration Suite (ZCS). Au moment du piratage, la vuln\u00e9rabilit\u00e9 \u00e9tait qualifi\u00e9e de zero-day sans correctif depuis plus d’un mois. La vuln\u00e9rabilit\u00e9 est une faille d’ex\u00e9cution de code \u00e0 distance r\u00e9pertori\u00e9e sous … Continue reading PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":4237,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[6],"tags":[],"class_list":["post-4485","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-actualite"],"yoast_head":"\nPR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY - Blog KoDDoS<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY - Blog KoDDoS\" \/>\n<meta property=\"og:description\" content=\"La soci\u00e9t\u00e9 de cybers\u00e9curit\u00e9 Kaspersky a r\u00e9v\u00e9l\u00e9, dans un tweet, que 876 serveurs ont \u00e9t\u00e9 compromis dans le cadre d’une vuln\u00e9rabilit\u00e9 critique de Zimbra Collaboration Suite (ZCS). Au moment du piratage, la vuln\u00e9rabilit\u00e9 \u00e9tait qualifi\u00e9e de zero-day sans correctif depuis plus d’un mois. La vuln\u00e9rabilit\u00e9 est une faille d’ex\u00e9cution de code \u00e0 distance r\u00e9pertori\u00e9e sous … Continue reading PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog KoDDoS\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/koddosCom\" \/>\n<meta property=\"article:published_time\" content=\"2022-10-16T03:57:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-10-17T16:00:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/fr.koddos.net\/blog\/wp-content\/uploads\/2022\/06\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"426\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"KoDDoS\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@koddoscom\" \/>\n<meta name=\"twitter:site\" content=\"@koddoscom\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"KoDDoS\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/\"},\"author\":{\"name\":\"KoDDoS\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#\\\/schema\\\/person\\\/d22f7fb31dc4d117c9eb5c9cfe533f85\"},\"headline\":\"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY\",\"datePublished\":\"2022-10-16T03:57:00+00:00\",\"dateModified\":\"2022-10-17T16:00:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/\"},\"wordCount\":959,\"publisher\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/fr.koddos.net\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1\",\"articleSection\":[\"Actualit\u00e9s\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/\",\"url\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/\",\"name\":\"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY - Blog KoDDoS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/fr.koddos.net\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1\",\"datePublished\":\"2022-10-16T03:57:00+00:00\",\"dateModified\":\"2022-10-17T16:00:21+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/fr.koddos.net\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/fr.koddos.net\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1\",\"width\":640,\"height\":426},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/\",\"name\":\"Blog KoDDoS\",\"description\":\"Blog KoDDoS est un blog d\u2019information et d\u2019actualit\u00e9 focalis\u00e9 sur le hacking, la cyber criminalit\u00e9, la vie priv\u00e9e et la surveillance.\",\"publisher\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#organization\",\"name\":\"KoDDoS\",\"url\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i1.wp.com\\\/fr.koddos.net\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/02\\\/logo.png?fit=258%2C55&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i1.wp.com\\\/fr.koddos.net\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/02\\\/logo.png?fit=258%2C55&ssl=1\",\"width\":258,\"height\":55,\"caption\":\"KoDDoS\"},\"image\":{\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/koddosCom\",\"https:\\\/\\\/x.com\\\/koddoscom\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/#\\\/schema\\\/person\\\/d22f7fb31dc4d117c9eb5c9cfe533f85\",\"name\":\"KoDDoS\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/239872ddb935e40a5bf46e7421e0fdd8419ae8e91164a61d84219911f7648c73?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/239872ddb935e40a5bf46e7421e0fdd8419ae8e91164a61d84219911f7648c73?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/239872ddb935e40a5bf46e7421e0fdd8419ae8e91164a61d84219911f7648c73?s=96&d=mm&r=g\",\"caption\":\"KoDDoS\"},\"url\":\"https:\\\/\\\/fr.koddos.net\\\/blog\\\/author\\\/oiyndjepop\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY - Blog KoDDoS","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/","og_locale":"fr_FR","og_type":"article","og_title":"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY - Blog KoDDoS","og_description":"La soci\u00e9t\u00e9 de cybers\u00e9curit\u00e9 Kaspersky a r\u00e9v\u00e9l\u00e9, dans un tweet, que 876 serveurs ont \u00e9t\u00e9 compromis dans le cadre d’une vuln\u00e9rabilit\u00e9 critique de Zimbra Collaboration Suite (ZCS). Au moment du piratage, la vuln\u00e9rabilit\u00e9 \u00e9tait qualifi\u00e9e de zero-day sans correctif depuis plus d’un mois. La vuln\u00e9rabilit\u00e9 est une faille d’ex\u00e9cution de code \u00e0 distance r\u00e9pertori\u00e9e sous … Continue reading PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY","og_url":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/","og_site_name":"Blog KoDDoS","article_publisher":"https:\/\/www.facebook.com\/koddosCom","article_published_time":"2022-10-16T03:57:00+00:00","article_modified_time":"2022-10-17T16:00:21+00:00","og_image":[{"width":640,"height":426,"url":"https:\/\/fr.koddos.net\/blog\/wp-content\/uploads\/2022\/06\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp","type":"image\/webp"}],"author":"KoDDoS","twitter_card":"summary_large_image","twitter_creator":"@koddoscom","twitter_site":"@koddoscom","twitter_misc":{"\u00c9crit par":"KoDDoS","Dur\u00e9e de lecture estim\u00e9e":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/#article","isPartOf":{"@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/"},"author":{"name":"KoDDoS","@id":"https:\/\/fr.koddos.net\/blog\/#\/schema\/person\/d22f7fb31dc4d117c9eb5c9cfe533f85"},"headline":"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY","datePublished":"2022-10-16T03:57:00+00:00","dateModified":"2022-10-17T16:00:21+00:00","mainEntityOfPage":{"@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/"},"wordCount":959,"publisher":{"@id":"https:\/\/fr.koddos.net\/blog\/#organization"},"image":{"@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/fr.koddos.net\/blog\/wp-content\/uploads\/2022\/06\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1","articleSection":["Actualit\u00e9s"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/","url":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/","name":"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY - Blog KoDDoS","isPartOf":{"@id":"https:\/\/fr.koddos.net\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/#primaryimage"},"image":{"@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/fr.koddos.net\/blog\/wp-content\/uploads\/2022\/06\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1","datePublished":"2022-10-16T03:57:00+00:00","dateModified":"2022-10-17T16:00:21+00:00","breadcrumb":{"@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/#primaryimage","url":"https:\/\/i0.wp.com\/fr.koddos.net\/blog\/wp-content\/uploads\/2022\/06\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1","contentUrl":"https:\/\/i0.wp.com\/fr.koddos.net\/blog\/wp-content\/uploads\/2022\/06\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1","width":640,"height":426},{"@type":"BreadcrumbList","@id":"https:\/\/fr.koddos.net\/blog\/pres-de-900-serveurs-zimbra-cs-exploites-suite-a-une-vulnerabilite-zero-day\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/fr.koddos.net\/blog\/"},{"@type":"ListItem","position":2,"name":"PR\u00c8S DE 900 SERVEURS ZIMBRA CS EXPLOIT\u00c9S SUITE \u00c0 UNE VULN\u00c9RABILIT\u00c9 ZERO-DAY"}]},{"@type":"WebSite","@id":"https:\/\/fr.koddos.net\/blog\/#website","url":"https:\/\/fr.koddos.net\/blog\/","name":"Blog KoDDoS","description":"Blog KoDDoS est un blog d\u2019information et d\u2019actualit\u00e9 focalis\u00e9 sur le hacking, la cyber criminalit\u00e9, la vie priv\u00e9e et la surveillance.","publisher":{"@id":"https:\/\/fr.koddos.net\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fr.koddos.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/fr.koddos.net\/blog\/#organization","name":"KoDDoS","url":"https:\/\/fr.koddos.net\/blog\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/fr.koddos.net\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/i1.wp.com\/fr.koddos.net\/blog\/wp-content\/uploads\/2018\/02\/logo.png?fit=258%2C55&ssl=1","contentUrl":"https:\/\/i1.wp.com\/fr.koddos.net\/blog\/wp-content\/uploads\/2018\/02\/logo.png?fit=258%2C55&ssl=1","width":258,"height":55,"caption":"KoDDoS"},"image":{"@id":"https:\/\/fr.koddos.net\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/koddosCom","https:\/\/x.com\/koddoscom"]},{"@type":"Person","@id":"https:\/\/fr.koddos.net\/blog\/#\/schema\/person\/d22f7fb31dc4d117c9eb5c9cfe533f85","name":"KoDDoS","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/239872ddb935e40a5bf46e7421e0fdd8419ae8e91164a61d84219911f7648c73?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/239872ddb935e40a5bf46e7421e0fdd8419ae8e91164a61d84219911f7648c73?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/239872ddb935e40a5bf46e7421e0fdd8419ae8e91164a61d84219911f7648c73?s=96&d=mm&r=g","caption":"KoDDoS"},"url":"https:\/\/fr.koddos.net\/blog\/author\/oiyndjepop\/"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/fr.koddos.net\/blog\/wp-content\/uploads\/2022\/06\/BlackCat-ransomware-deployed-on-unpatched-Exchange-servers.webp?fit=640%2C426&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9DjzA-1al","jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/posts\/4485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/comments?post=4485"}],"version-history":[{"count":1,"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/posts\/4485\/revisions"}],"predecessor-version":[{"id":4486,"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/posts\/4485\/revisions\/4486"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/media\/4237"}],"wp:attachment":[{"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/media?parent=4485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/categories?post=4485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fr.koddos.net\/blog\/wp-json\/wp\/v2\/tags?post=4485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}