title: Zimbra zmslapd arbitrary module load
description: Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
problem types: CWE-284 Improper Access Control
affected:
{
product: Zimbra Server
vendor: Synacor
versions:
lessThanOrEqual: 9.0.0.p27, status: affected, version: 9.0.0.p27, versionType: custom
lessThanOrEqual: 8.8.15.p34, status: affected, version: 8.8.15.p34, versionType: custom
}
exploits: Exploit originally published by the discoverer: https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit/