Introduction CVE-2024-45519 is a major security issue in Zimbra's postjournal service, which is part of the Zimbra Collaboration Suite. This vulnerability enables attackers to execute malicious instructions on your server without logging in, allowing them to seize control of the system. The vulnerability is being actively abused, so take action if you use Zimbra. This article will show you how to use a simple Python script to remotely connect to your Zimbra server and stop the vulnerable postjournal service, lowering the chance of an attack. How The Script Works The Python script employs Paramiko, a module that enables Python to connect to servers over SSH. Once connected, the script executes a command on the server to deactivate the postjournal service, which is where the vulnerability lies, before restarting Zimbra to implement the modifications. SSH Connection: The script prompts you for the server's IP address, SSH port (default: 22), and login information. It then utilizes this information to create a secure connection with the Zimbra server. Disabling the Service: It runs the following command: zmlocalconfig -e postjournal_enabled=false && zmcontrol restart This disables the vulnerable postjournal service and restarts Zimbra to apply the changes. How to Use the Script Install Python and Paramiko: First, you need to have Python 3 installed on your system. You also need the Paramiko library, which allows you to connect to your server via SSH. Install it by running: pip install paramiko Run the script: Save the script as remedy.py, then open a terminal and run it: python3 remedy.py Enter Your Server Details: The script will ask you for: Zimbra server IP/hostname: Enter the IP address or hostname of your server. SSH Port: The default is 22, but if your SSH runs on a different port, enter that. Username and Password: These are the credentials you use to log in to your server via SSH. Service Disabled: Once the script runs successfully, the postjournal service will be disabled, and Zimbra will restart to apply the changes. Final Thoughts It is simple and effective to lessen the risk that CVE-2024-45519 poses by disabling the postjournal service. While this script helps protect your Zimbra installation, you should also ensure your systems are regularly updated with the latest patches to stay secure. References Tenable's CVE-2024-45519 Overview The Hacker News Report on Active Exploitation Zimbra Security Advisories