CVE-2020-7247

OpenSMTPD 6.6 contains a critical, unauthenticated remote code execution flaw (CWE-78) caused by an incorrect return value from input validation in smtp_mailaddr in smtp_session.c. A remote attacker triggers it during a normal SMTP session by supplying shell metacharacters in the MAIL FROM field; when OpenSMTPD runs with its default (uncommented) configuration, the unsanitized address is passed to a shell during mail delivery, executing attacker-supplied commands. Because the affected delivery path runs with root privileges, the attacker gains arbitrary command execution as root on the mail server. Affected deployments include OpenBSD 6.6, where OpenSMTPD is the default mail daemon, plus Debian, Fedora, and Ubuntu systems shipping OpenSMTPD 6.6. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), multiple public PoC exploits exist, and EPSS estimates a 99% probability of exploitation within 30 days.

What to do: Apply vendor updates per CISA's required action: upgrade OpenSMTPD to the patched release (6.6.4p1 or later per vendor advisories) or install the OpenBSD 6.6 errata patch, and pull updated packages from Debian, Fedora, or Ubuntu. Verify your running version and whether the default (uncommented) smtpd.conf is in use; until patched, restrict access to the SMTP service from untrusted networks. Hunt for signs of compromise, such as unexpected commands or processes executed as root by smtpd.