Zimbra CVE-2024-45519: postjournal Command Injection

What to do

1. Check the version on every mailbox and MTA node with su - zimbra -c 'zmcontrol -v'.
2. Check whether postjournal is enabled with zmlocalconfig postjournal_enabled; turn it off if you do not use journaling.
3. Review postconf mynetworks and remove broad ranges; only trusted relays belong there.
4. Upgrade to the current 10.1 release (10.1.20 or later), not just the 2024 patch level.
5. If postjournal was on and unpatched after Sep 28, 2024, hunt for the web shell and rebuild if you find it.

How to check if you are affected or compromised

• Look for /opt/zimbra/jetty/webapps/zimbraAdmin/public/jsp/zimbraConfig.jsp, the web shell path Proofpoint reported, and any other unexpected JSP files.
• Search mail logs for recipient or CC addresses containing $( , backticks or long base64 strings.
• Check web access logs for requests to zimbraConfig.jsp and for JACTION or unusual JSESSIONID cookies if cookies are logged.
• Look for curl or sh processes started by the zimbra user and for outbound connections from the mail server to unknown hosts.

What happened#

On September 4, 2024, Zimbra released 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9 and 10.1.1. They fixed a flaw in the postjournal service, which Zimbra described as one that "may allow unauthenticated users to execute commands" (SecurityWeek). The researcher lebr0nli (Alan Li) is credited, per The Hacker News. The CVE record was published on October 2. The CNA scores it CVSS 3.1 10.0 and NVD gives 9.8.

Postjournal parses incoming SMTP mail for journaling. ProjectDiscovery compared the patched and unpatched binaries in late September. In the old code, the recipient address went into a string passed straight to popen, so $(...) inside an address ran as a shell command. The patch switches to execvp with an argument array and adds input checks. The researchers tested on port 10027 and found the same attack worked over SMTP port 25.

Attacks followed at once. HarfangLab's Ivan Kwiatkowski warned of "mass-exploitation", and Proofpoint confirmed activity from September 28, a day after the proof of concept (BleepingComputer). The emails spoofed Gmail and carried fake CC addresses holding base64 strings, which the server ran with sh. Decoded, they wrote a web shell to /jetty/webapps/zimbraAdmin/public/jsp/zimbraConfig.jsp. The shell waits for a fixed JSESSIONID cookie, then runs base64 commands from a JACTION cookie and can download and run files. Proofpoint did not attribute the activity. CISA added the CVE to the KEV catalog on October 3, 2024.

Who is affected#

Zimbra 8.8.15 before Patch 46, 9.0.0 before Patch 41, 10.0 before 10.0.9 and 10.1.0. The service must be enabled, and it is off by default. ProjectDiscovery also found that SMTP relay rules block the attack unless the sender is authenticated or inside mynetworks. On their test server, the default mynetworks included a /20 range covering their own public IP. So "default settings" did not reliably mean "safe".

Do you really need to act?#

Most Zimbra servers never ran postjournal, and this is a two-year-old fix. Check the setting rather than drop everything. If postjournal was enabled while unpatched in late 2024, treat the server as possibly backdoored. The attack needed no login and no user action, and it ran commands on the server that holds every mailbox. A later patch does not remove a planted JSP shell.

Being patched for this CVE is not the end of it. Zimbra keeps appearing in KEV, most recently with SNMP command injection CVE-2026-73570. That bug is fixed in Zimbra 10.1.20, and that July 2026 release shipped only on the 10.1 line.

What to do now#

1. Check each node's version: su - zimbra -c 'zmcontrol -v'.
2. Check postjournal: su - zimbra -c 'zmlocalconfig postjournal_enabled'. If you do not need it, set it to false with zmlocalconfig -e and restart.
3. Check postconf mynetworks. It should list only your own relays, not broad provider ranges.
4. Upgrade to 10.1.20 or later. Plan a migration for servers on 8.8.15, 9.0 or 10.0.

How to tell if you were hit#

• Run ls -la /opt/zimbra/jetty/webapps/zimbraAdmin/public/jsp/ and look for zimbraConfig.jsp or any JSP you did not install.
• Search mail logs for odd recipients: grep -E '\$\(|base64' /var/log/zimbra.log*. Look for CC or RCPT addresses with long encoded strings.
• Check access logs for requests to zimbraConfig.jsp, and process history for sh or curl started by the zimbra user.
• If you find the shell, rebuild the server, rotate Zimbra and LDAP secrets, and review mailbox access since September 2024.

Timeline#

• Sep 4, 2024 — Zimbra releases fixes in 8.8.15 P46, 9.0.0 P41, 10.0.9 and 10.1.1.
• Sep 28, 2024 — ProjectDiscovery's analysis and proof of concept are public; Proofpoint sees the first exploitation attempts.
• Oct 2, 2024 — CVE-2024-45519 is published; press reports mass exploitation.
• Oct 3, 2024 — CISA adds the CVE to KEV, with an October 24 deadline.
• Jul 20, 2026 — Zimbra 10.1.20 ships, the current recommended baseline.

Vulnerability records

• CVE-2024-45519 · KEV 2024-10-03 · The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE record — CVE-2024-45519 cve.org
2. NVD — CVE-2024-45519 nvd.nist.gov
3. CISA — Known Exploited Vulnerabilities: CVE-2024-45519 cisa.gov
4. ProjectDiscovery — Zimbra Remote Code Execution (CVE-2024-45519) projectdiscovery.io
5. Zimbra — Patch Release Update: Zimbra 10.1.20 (Jul 20, 2026) blog.zimbra.com

Coverage and analysis

1. The Hacker News — Researchers sound alarm on active attacks exploiting critical Zimbra postjournal flaw thehackernews.com
2. BleepingComputer — Critical Zimbra RCE flaw exploited to backdoor servers using emails bleepingcomputer.com
3. SecurityWeek — Critical Zimbra vulnerability exploited one day after PoC release securityweek.com