OpenSMTPD MAIL FROM RCE

Product: OpenBSD OpenSMTPD
CVE: CVE-2020-7247
Disclosed: 2020-01-28
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: OpenSMTPD 6.4.0 through 6.6.1 (OpenBSD and portable versions).
Fixed: OpenSMTPD 6.6.2 (portable 6.6.2p1); OpenBSD 6.6 errata 019.

Summary

A Qualys-found bug in OpenBSD's mail server. Shell metacharacters in the SMTP MAIL FROM address end up executed by the shell as root when the message is handed to the local delivery agent.

Root cause

smtp_mailaddr() rejects addresses with an invalid local part, except when the domain part is empty: it then fills in the default domain and returns success. Characters such as ';' and space slip through and reach the MDA command line (e.g. mail.local -f %{mbox.from}), which mda_unpriv() runs through /bin/sh -c as root for mbox delivery.

Impact

Unauthenticated remote command execution as root on OpenSMTPD servers.

Public PoC

$ nc mail.lab 25
HELO professor.falken
MAIL FROM:<;sleep 66;>
RCPT TO:<root>
DATA
.
QUIT

Source: Qualys advisory - CVE-2020-7247

Detection

Check smtpd version (smtpd -h / package version); search maillog for MAIL FROM containing ';' or shell syntax. Metasploit module exploit/unix/smtp/opensmtpd_mail_from_rce.

Mitigation

Upgrade to OpenSMTPD 6.6.2 or apply the OpenBSD errata patch.