zimbra-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes curl commands with plaintext passwords and explicitly requires documenting "exact curl commands and responses" (which can contain authTokens or other secrets from SOAP responses or cloud metadata), forcing the agent to handle and potentially output secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include Zimbra UploadServlet endpoints and a proxy SSRF endpoint (plus internal metadata/local service targets) that can be used to upload or fetch files, exfiltrate credentials, or deliver malware — high risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is an explicit offensive playbook describing unauthenticated user enumeration, exploitation of CVE-2022-37042 (unauthenticated path traversal in UploadServlet), internal SSRF probes (including cloud metadata access), and checks for exposed admin access — clearly intended to enable unauthorized access and data theft.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s Phase 1/2/3/4/5 runtime workflow uses curl to POST and GET attacker-influenced free text (e.g., SOAP XML bodies and upload traversal payloads built with user-supplied TARGET/$user and string literals) into Zimbra service endpoints, causing the agent to ingest response bodies that may contain attacker-influenced or outsider-submitted content.