Return of the WIZard

aka Exim deliver_message RCE

Product: Exim Exim MTA
CVE: CVE-2019-10149
Disclosed: 2019-06-05
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Exim 4.87 to 4.91.
Fixed: Exim 4.92 (released 2019-02-10, fix not identified as security-relevant until June).

Summary

A command injection in the Exim mail server found by Qualys, named after Sendmail's 1980s WIZ backdoor. A crafted recipient address makes Exim expand and run attacker-supplied commands as root, and Sandworm (GRU) was later seen exploiting it at scale.

Root cause

In deliver_message(), when a recipient is failed (process_recipients != RECIP_ACCEPT, e.g. more than received_headers_max Received: headers), the event code calls expand_string("${local_part:<address>}") on the recipient address, which honours ${run{...}} expansion items. Locally this is instant; remotely it works in non-default configs (verify = recipient removed, local_part_suffix, relay domains) or, by default, by keeping a connection to the server open for 7 days so a bounce is processed. Commands run via execv() as root.

Impact

Remote command execution as root on Exim mail servers.

Public PoC

$ nc 127.0.0.1 25
HELO localhost
MAIL FROM:<>
RCPT TO:<${run{\x2Fbin\x2Fsh\t-c\t\x22id\x3E\x3E\x2Ftmp\x2Fid\x22}}@localhost>
DATA
Received: 1
...(31 Received: headers, > received_headers_max)...
Received: 31

.
QUIT

Source: Qualys advisory - Return of the WIZard

Detection

Check exim -bV version. Search mainlog/rejectlog for '${run' or '\x2Fbin' in RCPT TO addresses. Nmap/nuclei have version-based checks.

Mitigation

Upgrade to Exim 4.92 or later (current releases).