CVE-2021-35209

CVE-2021-35209 is a critical vulnerability affecting Zimbra Collaboration Suite versions 8.8 prior to Patch 23 and 9.x prior to Patch 16, where an attacker can manipulate the X-Host header in proxied requests to bypass host whitelisting. This allows for Server-Side Request Forgery (SSRF) due to the X-Host header overwriting the Host header without proper validation. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with no user interaction, leading to potential complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating high awareness and potential for future exploitation.