CVE-2019-9670: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

CVE-2019-9670 is an XML external entity (XXE) vulnerability in the mailboxd component of Synacor Zimbra Collaboration Suite (ZCS). It stems from improper restriction of XML external entity references, allowing crafted XML input to be processed in unsafe ways. For IT and security teams running Zimbra, this matters because mailboxd is central to mail and collaboration services; successful abuse can lead to unauthorized data access or further compromise of the messaging platform, so timely identification and remediation are essential.

How it works

This flaw belongs to CWE-611: Improper Restriction of XML External Entity Reference. In products that parse XML, the parser may be configured to resolve external entities—references that can point to local files, internal network resources, or other data sources. When restriction is missing or incomplete, an attacker who can supply XML to the vulnerable component (here, mailboxd) may cause the parser to retrieve or disclose information that should remain inaccessible.

Abuse typically involves sending specially formed XML that triggers entity resolution. The exact request paths, payloads, or resulting impact depend on the Zimbra configuration and must be confirmed against the vendor advisory; defenders should treat any untrusted XML input to mailboxd as a potential vector for this class of attack without assuming specific exploit mechanics.

Am I affected? How to find it in your systems

Synacor Zimbra Collaboration Suite is commonly deployed as an on-premises or self-hosted email and collaboration platform. mailboxd is a core service process, so any ZCS installation that exposes or uses this component should be inventoried.

• Build an inventory of all Zimbra Collaboration Suite instances: check package managers, deployment manifests, configuration management databases, and running processes for ZCS/mailboxd.
• Record the installed version and patch level of each instance and compare it directly to the fixed versions listed in the vendor advisory for CVE-2019-9670; do not rely on secondary sources for version ranges.
• Note whether mailboxd is reachable from untrusted networks or accepts XML from external clients, webmail, or APIs—these increase exposure for XXE-class issues.
• Review application and system logs around mailboxd for unusual XML parsing errors, unexpected outbound connection attempts from the mail server, or anomalous file-access patterns that could indicate probing or exploitation; correlate with authentication and access logs.

If public detail on exact affected builds is limited in your environment documentation, treat all unpatched ZCS deployments as potentially vulnerable until verified against the official advisory.

How to remediate

Patch first. Apply the updates provided by the vendor for Synacor Zimbra Collaboration Suite exactly as described in the official advisory for CVE-2019-9670. CISA’s required action is to apply updates per vendor instructions; follow those steps, including any prerequisite or post-update service restarts.

• After patching, confirm the new version string and that mailboxd is running the updated code.
• For this weakness class, harden XML processing where the product allows: disable external entity resolution, restrict DTDs, and limit the privileges of the mailboxd process so that even successful entity resolution yields minimal data.
• Ensure mailboxd and related services run with least privilege, and keep the underlying OS and supporting libraries current.
• Re-validate network exposure: restrict administrative and mail-protocol interfaces to trusted networks where feasible.

If you can't patch immediately

Until the vendor update can be applied, reduce risk with compensating controls tailored to XXE and mail-server exposure.

• Segment Zimbra hosts so that mailboxd is not directly reachable from the internet or untrusted segments; place it behind reverse proxies or mail gateways that can filter or normalize XML-bearing traffic.
• If a web application firewall or reverse-proxy virtual-patching capability is available, enable rules that block or sanitize suspicious XML constructs (external entity declarations, unexpected DOCTYPE usage) aimed at known Zimbra endpoints—tune carefully to avoid breaking legitimate clients.
• Disable or restrict any optional features or interfaces that accept arbitrary XML if the product configuration permits and business needs allow.
• Increase monitoring: alert on anomalous outbound connections from the Zimbra host, spikes in XML parse failures, or unusual file-system access by the mailboxd process. Retain logs for forensic review.
• Enforce strict network egress controls so the mail server cannot freely reach internal file shares or sensitive services that an XXE payload might target.

These measures lower likelihood and impact but are not a substitute for the vendor patch.

If your data may have been exposed

Actively exploited vulnerabilities can lead to unauthorized access or data exposure even when ransomware use is not documented for this CVE. If you suspect compromise, follow your incident-response process: isolate affected hosts, preserve logs, and assess what mailbox or configuration data may have been reachable. As a further check, you can run a free exposure scan of your email addresses against known breach datasets to see whether credentials or related information have appeared in prior incidents.