OS Command Injection in OpenSMTPD - CVE-2020-7247
Published: January 29, 2020 / Updated: March 3, 2023
Vulnerability identifier: #VU24745
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-7247
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper validation of user-supplied input passed within the smtp_mailaddr() function. A remote unauthenticated attacker can send a specially crafted MAIL FROM command and execute arbitrary OS commands on the target system with root privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
OpenSMTPD
Arch Linux
Fedora
opensmtpd (Debian package)
opensmtpd (Alpine package)
libasr
opensmtpd
Arch Linux
Fedora
opensmtpd (Debian package)
opensmtpd (Alpine package)
libasr
opensmtpd
How to mitigate CVE-2020-7247
Install updates from vendor's website.
OpenSMTPD - addressed in versions 6.6.2, 6.6.2p1
opensmtpd (Debian package) - addressed in versions 6.0.2p1-2+deb9u2, 6.0.3p1-5+deb10u3
opensmtpd (Alpine package) - update to 6.7.1p1-r0
libasr - update to 1.0.4-2.el7
opensmtpd - addressed in versions 6.6.4p1-1.el8, 6.6.4p1-2.fc32, 6.6.4p1-3.el7
opensmtpd (Debian package) - addressed in versions 6.0.2p1-2+deb9u2, 6.0.3p1-5+deb10u3
opensmtpd (Alpine package) - update to 6.7.1p1-r0
libasr - update to 1.0.4-2.el7
opensmtpd - addressed in versions 6.6.4p1-1.el8, 6.6.4p1-2.fc32, 6.6.4p1-3.el7
Links to Public Exploits and PoC-codes
- Exploit #8883 - CVE-2020-7247 (CVE-2020-7247 Remote Code Execution POC) (March 3, 2023)
- Exploit #8859 - ENSIMAG_EXPLOIT_CVE1_3A (Ensimag 3A - Exploit on CVE 2020-7247) (February 21, 2023)
- Exploit #7328 - shai_hulud (Worm written in python, abuses CVE-2020-7247) (February 8, 2022)
- Exploit #7086 - CVE-2020-7247-POC (Proof of concept for CVE-2020-7247 for educational purposes.) (November 29, 2021)
- Exploit #6446 - CVE-2020-7247 (PoC exploit for CVE-2020-7247 OpenSMTPD 6.4.0 < 6.6.1 Remote Code Execution) (June 20, 2021)
- Exploit #5794 - OpenSMTPD 6.6.2 - Remote Code Execution (June 17, 2021)
- Exploit #5772 - OpenSMTPD 6.4.0 < 6.6.1 - Local Privilege Escalation + Remote Code Execution (June 17, 2021)
- Exploit #5154 - CVE-2020-7247-exploit (OpenSMTPD 6.4.0 - 6.6.1 Remote Code Execution PoC exploit) (February 14, 2021)
- Exploit #5109 - CVE-2020-7247 (This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtp_mailaddr()” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user) (February 1, 2021)
- Exploit #2674 - cve-2020-7247 (OpenSMTPD version 6.6.2 remote code execution exploit) (May 18, 2020)
- Exploit #288 - CVE-2020-7247 (Proof Of Concept Exploit for CVE-2020-7247 (Remote Execution on OpenSMTPD < 6.6.2) (March 18, 2020)
- Exploit #289 - cve-2020-7247-exploit (Python exploit of cve-2020-7247) (March 18, 2020)
- Exploit #1482 - OpenSMTPD MAIL FROM Remote Code Execution (March 18, 2020)