Barracuda ESG TAR Attachment Command Injection
- Product
- Barracuda Networks Email Security Gateway (ESG) appliance
- CVE
- CVE-2023-2868
- Disclosed
- 2023-05-23
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Barracuda ESG appliance versions 5.1.3.001 through 9.2.0.006.
- Fixed
- Patch BNSF-36456 (May 2023); Barracuda later advised replacing compromised appliances.
Summary
A China-nexus actor (UNC4841) sent emails with crafted TAR attachments that triggered command injection on Barracuda Email Security Gateways, deploying SALTWATER, SEASPY and SEASIDE backdoors. Barracuda took the rare step of telling customers to replace affected hardware.
Root cause
The attachment-scanning module did not sanitize filenames inside .tar archives before using them in a Perl command executed by the shell. A crafted filename therefore results in command execution with the privileges of the ESG.
Impact
Unauthenticated code execution triggered simply by emailing the appliance, with persistent backdoors.
Detection
Search mail logs for suspicious .tar attachments and check for Mandiant/CISA IOCs (SEASPY, SALTWATER, SEASIDE).
Mitigation
Apply patches and replace compromised appliances per Barracuda guidance.