---
title: "Zimbra CVE-2024-45519: postjournal Command Injection"
url: https://erroneo.us/security/briefs/zimbra-cve-2024-45519-postjournal-rce/
description: "Zimbra postjournal ran shell commands from email addresses; fixed Sep 2024 and mass-exploited days after a PoC. Check postjournal, mynetworks and web shells."
type: security-brief
section: "Security Digest"
date_published: 2024-09-04
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-45519"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Zimbra CVE-2024-45519: postjournal Command Injection

**Verdict: Check exposure.** Patched in September 2024 and only reachable when postjournal is enabled, but it was mass-exploited; confirm the setting and your build, and hunt for the zimbraConfig.jsp web shell on any server that had postjournal on in late 2024.

- **Who must act:** Admins of self-hosted Zimbra servers that have postjournal enabled, or ever did, and anyone still running a 2024-era Zimbra build.
- **Who can relax:** Zimbra servers that never enabled postjournal and are on a current 10.1 release, and organizations that do not run Zimbra.
- **Affected:** Zimbra 8.8.15 before Patch 46; Zimbra 9.0.0 before Patch 41; Zimbra 10.0.x before 10.0.9; Zimbra 10.1.0 (before 10.1.1); Exploitable only when the postjournal service is enabled (off by default)
- **Fixed:** Zimbra 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9 and 10.1.1 (Sep 4, 2024); Recommended today: Zimbra 10.1.20 or later (Jul 20, 2026), which also fixes exploited CVE-2026-73570
- **CVEs:** CVE-2024-45519
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version on every mailbox and MTA node with su - zimbra -c 'zmcontrol -v'.
2. Check whether postjournal is enabled with zmlocalconfig postjournal_enabled; turn it off if you do not use journaling.
3. Review postconf mynetworks and remove broad ranges; only trusted relays belong there.
4. Upgrade to the current 10.1 release (10.1.20 or later), not just the 2024 patch level.
5. If postjournal was on and unpatched after Sep 28, 2024, hunt for the web shell and rebuild if you find it.

### How to check if you are affected

- Look for /opt/zimbra/jetty/webapps/zimbraAdmin/public/jsp/zimbraConfig.jsp, the web shell path Proofpoint reported, and any other unexpected JSP files.
- Search mail logs for recipient or CC addresses containing $( , backticks or long base64 strings.
- Check web access logs for requests to zimbraConfig.jsp and for JACTION or unusual JSESSIONID cookies if cookies are logged.
- Look for curl or sh processes started by the zimbra user and for outbound connections from the mail server to unknown hosts.

## What happened

On September 4, 2024, Zimbra released 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9 and 10.1.1. They fixed a flaw in the postjournal service, which Zimbra described as one that "may allow unauthenticated users to execute commands" ([SecurityWeek](https://www.securityweek.com/critical-zimbra-vulnerability-exploited-one-day-after-poc-release/)). The researcher lebr0nli (Alan Li) is credited, per [The Hacker News](https://thehackernews.com/2024/10/researchers-sound-alarm-on-active.html). The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-45519) was published on October 2. The CNA scores it CVSS 3.1 10.0 and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-45519) gives 9.8.

Postjournal parses incoming SMTP mail for journaling. [ProjectDiscovery](https://projectdiscovery.io/blog/zimbra-remote-code-execution/) compared the patched and unpatched binaries in late September. In the old code, the recipient address went into a string passed straight to `popen`, so `$(...)` inside an address ran as a shell command. The patch switches to `execvp` with an argument array and adds input checks. The researchers tested on port 10027 and found the same attack worked over SMTP port 25.

Attacks followed at once. HarfangLab's Ivan Kwiatkowski warned of "mass-exploitation", and Proofpoint confirmed activity from September 28, a day after the proof of concept ([BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-exploited-to-backdoor-servers-using-emails/)). The emails spoofed Gmail and carried fake CC addresses holding base64 strings, which the server ran with `sh`. Decoded, they wrote a web shell to `/jetty/webapps/zimbraAdmin/public/jsp/zimbraConfig.jsp`. The shell waits for a fixed JSESSIONID cookie, then runs base64 commands from a JACTION cookie and can download and run files. Proofpoint did not attribute the activity. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45519) on October 3, 2024.

## Who is affected

Zimbra 8.8.15 before Patch 46, 9.0.0 before Patch 41, 10.0 before 10.0.9 and 10.1.0. The service must be enabled, and it is off by default. ProjectDiscovery also found that SMTP relay rules block the attack unless the sender is authenticated or inside `mynetworks`. On their test server, the default `mynetworks` included a /20 range covering their own public IP. So "default settings" did not reliably mean "safe".

## Do you really need to act?

Most Zimbra servers never ran postjournal, and this is a two-year-old fix. Check the setting rather than drop everything. If postjournal was enabled while unpatched in late 2024, treat the server as possibly backdoored. The attack needed no login and no user action, and it ran commands on the server that holds every mailbox. A later patch does not remove a planted JSP shell.

Being patched for this CVE is not the end of it. Zimbra keeps appearing in KEV, most recently with SNMP command injection CVE-2026-73570. That bug is fixed in [Zimbra 10.1.20](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/), and that July 2026 release shipped only on the 10.1 line.

## What to do now

1. Check each node's version: `su - zimbra -c 'zmcontrol -v'`.
2. Check postjournal: `su - zimbra -c 'zmlocalconfig postjournal_enabled'`. If you do not need it, set it to false with `zmlocalconfig -e` and restart.
3. Check `postconf mynetworks`. It should list only your own relays, not broad provider ranges.
4. Upgrade to 10.1.20 or later. Plan a migration for servers on 8.8.15, 9.0 or 10.0.

## How to tell if you were hit

- Run `ls -la /opt/zimbra/jetty/webapps/zimbraAdmin/public/jsp/` and look for `zimbraConfig.jsp` or any JSP you did not install.
- Search mail logs for odd recipients: `grep -E '\$\(|base64' /var/log/zimbra.log*`. Look for CC or RCPT addresses with long encoded strings.
- Check access logs for requests to `zimbraConfig.jsp`, and process history for `sh` or `curl` started by the zimbra user.
- If you find the shell, rebuild the server, rotate Zimbra and LDAP secrets, and review mailbox access since September 2024.

## Timeline

- Sep 4, 2024 — Zimbra releases fixes in 8.8.15 P46, 9.0.0 P41, 10.0.9 and 10.1.1.
- Sep 28, 2024 — ProjectDiscovery's analysis and proof of concept are public; Proofpoint sees the first exploitation attempts.
- Oct 2, 2024 — CVE-2024-45519 is published; press reports mass exploitation.
- Oct 3, 2024 — CISA adds the CVE to KEV, with an October 24 deadline.
- Jul 20, 2026 — Zimbra 10.1.20 ships, the current recommended baseline.

## Sources

1. [CVE record — CVE-2024-45519](https://www.cve.org/CVERecord?id=CVE-2024-45519)
2. [NVD — CVE-2024-45519](https://nvd.nist.gov/vuln/detail/CVE-2024-45519)
3. [CISA — Known Exploited Vulnerabilities: CVE-2024-45519](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45519)
4. [ProjectDiscovery — Zimbra Remote Code Execution (CVE-2024-45519)](https://projectdiscovery.io/blog/zimbra-remote-code-execution/)
5. [Zimbra — Patch Release Update: Zimbra 10.1.20 (Jul 20, 2026)](https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/)
6. [The Hacker News — Researchers sound alarm on active attacks exploiting critical Zimbra postjournal flaw](https://thehackernews.com/2024/10/researchers-sound-alarm-on-active.html)
7. [BleepingComputer — Critical Zimbra RCE flaw exploited to backdoor servers using emails](https://www.bleepingcomputer.com/news/security/critical-zimbra-rce-flaw-exploited-to-backdoor-servers-using-emails/)
8. [SecurityWeek — Critical Zimbra vulnerability exploited one day after PoC release](https://www.securityweek.com/critical-zimbra-vulnerability-exploited-one-day-after-poc-release/)

---
Source page: https://erroneo.us/security/briefs/zimbra-cve-2024-45519-postjournal-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt