SecurEnvoy SecurMail up to 9.2 secupload2/upload.aspx filename path traversal

Summaryinfo

A vulnerability classified as critical has been found in SecurEnvoy SecurMail up to 9.2. This affects an unknown function of the file secupload2/upload.aspx. The manipulation of the argument filename with the input .. leads to path traversal. This vulnerability is uniquely identified as CVE-2018-7705. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in SecurEnvoy SecurMail up to 9.2. This issue affects some unknown processing of the file secupload2/upload.aspx. The manipulation of the argument filename with the input value .. leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, and integrity. The summary by CVE is:

Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. (dot dot) in the filename parameter to secupload2/upload.aspx.

The bug was discovered 03/12/2018. The weakness was disclosed 03/15/2018 as confirmed mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2018-7705 since 03/05/2018. The exploitation is known to be easy. The attack may be initiated remotely. Required for exploitation is a simple authentication. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1006 for this issue.

A public exploit has been developed by SEC Consult and been published before and not just after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:secupload2/upload.aspx it is possible to find vulnerable targets with Google Hacking. The commercial vulnerability scanner Qualys is able to test this issue with plugin 370828 (SecurEnvoy SecurMail multiple critical vulnerabilities).

Upgrading to version 9.2.501 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44285). The entries VDB-114613, VDB-114614, VDB-114615 and VDB-114616 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• SecurEnvoy

Name

• SecurMail

Version

• 9.0
• 9.1
• 9.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion