ALERT — New 21Nails Exim Bugs Expose Millions of Email Servers to Hacking
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-10149 | Unvalidated Email Recipient Enables Remote Command Execution in Exim MTA CVE-2019-10149 is an improper input validation flaw (CWE-78, OS command injection) in the deliver_message() function in /src/deliver.c of the Exim mail transfer agent, where email recipient addresses are not safely validated before use. A remote attacker triggers it by sending mail whose recipient address contains crafted Exim string-expansion syntax (such as ${run{...}}), causing Exim to expand and execute attacker-supplied operating-system commands during recipient verification or delivery. An attacker gains arbitrary remote command execution on the mail server, commonly with elevated privileges, enabling full system compromise, data theft, ransomware deployment (e.g., the Trinity ransomware campaign), or installation of botnet implants. Any organization running an internet-exposed Exim MTA in the affected version range is at risk, and Exim is widely deployed as the default mail server on many Linux distributions. Exploitation is confirmed in the wild: mass scanning and compromise campaigns began shortly after the June 2019 disclosure, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-01-10, and its EPSS score of 100% (100th percentile) reflects near-certain near-term exploitation risk. Do: Upgrade Exim to 4.92 or later, or install your distribution's patched Exim package, as required by CISA's KEV action ('apply updates per vendor instructions'); if patching must be delayed, restrict internet-facing SMTP access and tighten recipient-verification configuration. Check mail logs for suspicious MAIL FROM/RCPT TO addresses containing expansion syntax such as ${run{...}} or shell-like commands, and audit patched servers for post-compromise artifacts such as unusual cron jobs, downloaded binaries, or new authorized SSH keys. | 9.8 | 100% | KEV PoC ×5 |
| mass≈500,000+ internet-exposed Exim SMTP servers, with hundreds of thousands likely running vulnerable versions | |
| CVE-2020-28018 | Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL. Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL. NVD description · AI analysis pending | 9.8 group max | 57% |
| — |
Full article555 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 05, 2021
The maintainers of Exim have released patches to remediate as many as 21 security vulnerabilities in its software that could enable unauthenticated attackers to achieve complete remote code execution and gain root privileges.
Collectively named '21Nails,' the flaws include 11 vulnerabilities that require local access to the server and 10 other weaknesses that could be exploited remotely. The issues were discovered by Qualys and reported to Exim on Oct. 20, 2020.
"Some of the vulnerabilities can be chained together to obtain a full remote unauthenticated code execution and gain root privileges on the Exim Server," Bharat Jogi, senior manager at Qualys, said in a public disclosure. "Most of the vulnerabilities discovered by the Qualys Research Team for e.g. CVE-2020-28017 affects all versions of Exim going back all the way to 2004."
Exim is a popular mail transfer agent (MTA) used on Unix-like operating systems, with over 60% of the publicly reachable mail servers on the Internet running the software. A Shodan search reveals nearly four million Exim servers that are exposed online.
A quick summary of the 21 bugs is listed below. If successfully exploited, they could be used to tweak email settings and even add new accounts on the compromised mail servers. Technical specifics about the flaws can be accessed here.
Local vulnerabilities:
- CVE-2020-28007: Link attack in Exim's log directory
- CVE-2020-28008: Assorted attacks in Exim's spool directory
- CVE-2020-28014: Arbitrary file creation and clobbering
- CVE-2021-27216: Arbitrary file deletion
- CVE-2020-28011: Heap buffer overflow in queue_run()
- CVE-2020-28010: Heap out-of-bounds write in main()
- CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
- CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
- CVE-2020-28015: New-line injection into spool header file (local)
- CVE-2020-28012: Missing close-on-exec flag for privileged pipe
- CVE-2020-28009: Integer overflow in get_stdinput()
Remote vulnerabilities:
- CVE-2020-28017: Integer overflow in receive_add_recipient()
- CVE-2020-28020: Integer overflow in receive_msg()
- CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
- CVE-2020-28021: New-line injection into spool header file (remote)
- CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
- CVE-2020-28026: Line truncation and injection in spool_read_header()
- CVE-2020-28019: Failure to reset function pointer after BDAT error
- CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
- CVE-2020-28018: Use-after-free in tls-openssl.c
- CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
In light of the recent Microsoft Exchange server hacks, it's imperative the patches are applied immediately, as email servers have emerged as a lucrative target for espionage campaigns. In the past, flaws in Exim software have been actively exploited by bad actors to mount a variety of attacks, including deploying a Linux worm to install cryptocurrency miners on affected servers.
Last May, the U.S. National Security Agency (NSA) warned that Russian military operatives, publicly known as Sandworm Team, were taking advantage of a remote code execution vulnerability tracked as CVE-2019-10149 (aka The Return of the WIZard) to "add privileged users, disable network security settings, execute additional scripts for further network exploitation" at least since August 2019.
The NSA called it an "attacker's dream access."
"Mail Transfer Agents are interesting targets for attackers because they are usually accessible over the internet," Jogi said. "Once exploited, they could modify sensitive email settings on the mail servers, allow adversaries to create new accounts on the target mail servers."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/05/alert-new-21nails-exim-bugs-expose.html