OpenSMTPD 6.6 SMTP Session smtp_session.c MAIL FROM return value

Summaryinfo

A vulnerability classified as very critical has been found in OpenSMTPD 6.6. This affects an unknown part of the file smtp_session.c of the component SMTP Session Handler. Performing a manipulation of the argument MAIL FROM as part of Shell Metacharacter results in return value. This vulnerability is reported as CVE-2020-7247. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability, which was classified as very critical, was found in OpenSMTPD 6.6. This affects some unknown processing of the file smtp_session.c of the component SMTP Session Handler. The manipulation of the argument MAIL FROM as part of a Shell Metacharacter leads to a return value vulnerability. CWE is classifying the issue as CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

The weakness was disclosed 01/29/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2020-7247 since 01/20/2020. It is possible to initiate the attack remotely. Required for exploitation is a authentication. Technical details and a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/05/2025).

A public exploit has been developed by Qualys Security Advisory in Python and been published 1 days after the advisory. The exploit is shared for download at exploit-db.com. It is declared as attacked. We expect the 0-day to have been worth approximately $25k-$100k. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 03/25/2022 with a due date of 04/15/2022:

Apply updates per vendor instructions.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47984). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• OpenSMTPD

Version

• 6.6

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #154: LPE and RCE in OpenSMTPD (by misc)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion