A critical vulnerability affecting the Zimbra email solution platform allows unauthenticated attackers to steal login credentials without any user interaction. Specifically, this flaw abuses the memcached internal service, which is an in-memory key-value store that uses a text-based protocol to store and retrieve the public/private keys used for email accounts, so as to limit the number of HTTP requests to improve Zimbra’s performance. The vulnerability, tracked as CVE-2022-27924, is described as a memcached poisoning with an unauthenticated request flaw, and can be exploited via a Carriage Return Line Feed (CRLF) injection into the username of memcached lookups. This is done by creating a maliciously crafted HTTP packet and sending it to a vulnerable Zimbra instance to overwrite the Internet message Access Protocol (IMAP) route with their own address, funneling the plaintext email credentials and all of the IMAP traffic back to the threat actor. This all takes place without any victim interaction, and without generating any alerts for the victim. This flaw can also be exploited by something known as “response smuggling,” whereby an attacker continuously injects HTTP responses into the shared response streams of Memcached until there are more responses than work items. A spokesperson from SonarSource stated, “we can force random Memcached lookups to use injected responses instead of the correct response. This works because Zimbra did not validate the key of the Memcached response when consuming it.” This vulnerability has since been patched, and customers using Zimbra should ensure that they are running the most up-to-date patch.