What the script does:
0) it needs to run as root because it does a chown zimbra, chmod and zmprov as the zimbra user but it could be all done by zimbra user if you fix that in the script.
1) it backups the original 2 files
2) it patches a few lines to escape some input
3) it flushes the cache (no mailboxd restart is necessary) after running script so you are done
I also had requested the hot fix today and it just came in as I am writing this. I was able to do a diff with that and what my script generated and it appears identical. I claim no understanding of the zimbra code but I can read diff output for the patches.
It might be useful to someone in a similar situation.
Code: Select all
% cat /tmp/xss-zeroDay.sh
#!/bin/sh
#
# Run as root.
# will flush the cache so no mailboxd restart is necessary.
# will only patch once
#
# patch XSS zero day ZBUG-2642 on Feb 4, 2022 as documented here:
# https://forums.zimbra.org/viewtopic.php?f=15&t=70382
# patched pulled from here (Jholder):
# https://github.com/Zimbra/zm-web-client/pull/672/commits/76c23a937d2ab40cdfafad1d7a3546bfbf354704
#
multiDay=/opt/zimbra/jetty_base/webapps/zimbra/WEB-INF/tags/calendar/multiDay.tag
grep escapeXml $multiDay | grep -q newAppt
if [ $? -eq 1 ]; then
# backup of original
cp $multiDay $multiDay.bak
echo "Appying patch to $multiDay"
#
# Want to do this:
# a href="${newAppt}"
# to
# a href="${fn:escapeXml(newAppt)}"
#
perl - $multiDay <<'__HERE__' > $multiDay.out
my $match_str = quotemeta('href="${newAppt}');
my $replace_str = 'href="${fn:escapeXml(newAppt)}';
while (<>) {
s/$match_str/$replace_str/g;
print $_;
}
__HERE__
#
if [ -s $multiDay.out ]; then
mv $multiDay.out $multiDay
chown zimbra:zimbra $multiDay
chmod 644 $multiDay
echo "flushing cache... no mailbox restart required"
su - zimbra -c "zmprov fc -a all"
fi
else
echo "nothing to patch"
fi
# -------- monthView.tag --------------
monthView=/opt/zimbra/jetty_base/webapps/zimbra/WEB-INF/tags/calendar/monthView.tag
grep monthZoomUrl $monthView | grep escapeXml | grep -q dayClick
if [ $? -eq 1 ]; then
# backup of original
cp $monthView $monthView.bak
echo "Appying patch to $monthView"
#
# Want to do this:
# ${monthZoomUrl}
# to
# ${fn:escapeXml(monthZoomUrl)}
perl - $monthView <<'__HERE__' > $monthView.out
my $match_str = quotemeta('${monthZoomUrl}');
my $replace_str = '${fn:escapeXml(monthZoomUrl)}';
while (<>) {
s/$match_str/$replace_str/g;
print $_;
}
__HERE__
#
if [ -s $monthView.out ]; then
mv $monthView.out $monthView
chown zimbra:zimbra $monthView
chmod 644 $monthView
echo "flushing cache... no mailbox restart required"
su - zimbra -c "zmprov fc -a all"
fi
else
echo "nothing to patch"
fi
Jim
