How does Zimbra process JSP files and how can you enumerate JspServletWrapper instances?

Zimbra uses the Jetty framework as its web container. When a JSP is requested, the server compiles it into a Java file stored under /opt/zimbra/jetty_base/work/zimbra/jsp/. Each compiled JSP registers a JspServletWrapper instance in a ConcurrentHashMap. You can enumerate these instances via reflection by accessing the request's _scope, then _servlet, rctxt, and finally the jsps field to iterate over keys. --- **Related reading:** - [Setting up Zimbra Vulnerability Debugging Environment](/news/setting-up-zimbra-vulnerability-debugging-environment) — original article - [Penetration Techniques - Enabling Anonymous Access Shares on Windows Systems via Command Line](/news/penetration-techniques-enabling-anonymous-access-shares-on-windows-systems-via-command-line) - [Steganography Techniques - Hiding Payloads Using JPEG File Format](/news/steganography-techniques-hiding-payloads-using-jpeg-file-format) - [vRealize Log Insight Vulnerability Debugging Environment Setup](/news/vrealize-log-insight-vulnerability-debugging-environment-setup)