OS Command Injection in Exim - CVE-2019-13917
Published: July 25, 2019
Vulnerability identifier: #VU19368
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-13917
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to insufficient filtering of user-supplied data under certain conditions, e.g. if your configuration uses the ${sort } expansion. A remote unauthenticated attacker can send a specially crafted email, modify $local_part or $domain items, inject and execute arbitrary OS commands on the target system with root privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system however requires non-default exim configuration.
Affected software
Exim
Amazon Linux AMI
Arch Linux
Gentoo Linux
exim (Alpine package)
exim4 (Debian package)
Amazon Linux AMI
Arch Linux
Gentoo Linux
exim (Alpine package)
exim4 (Debian package)
How to mitigate CVE-2019-13917
Install updates from vendor's website.
Exim - update to 4.92.1
exim (Alpine package) - update to 4.92.1-r0
exim4 (Debian package) - update to 4.89-2+deb9u5
exim (Alpine package) - update to 4.92.1-r0
exim4 (Debian package) - update to 4.89-2+deb9u5