Recently some administrators experienced problems in their Zimbra installations, like high CPU usage or blank login page.

This is likely to be due to a vulnerability discovered in March being exploited. At the begining the explot was very basic and easy to clean, but during the last weeks of May the attacker gained a lot of expertise in Zimbra and is installing malicious files all around the system.

In a variation this upload resulted in wrong permissions on Zimbra’s frontend jsp files, from which an end user or administrator experience blank pages at login.

To quickly recover your Zimbra fix permissions with:

find /opt/zimbra/mailboxd/webapps -type d -exec chmod 0755 {} \;
find /opt/zimbra/mailboxd/webapps -type f -exec chmod 0644 {} \;

or more extensively:

/opt/zimbra/libexec/zmfixperms

Now by restarting Zimbra you should be able to login again.

More important now you need to cleanup your server.