PT-2023-20680 · Imapsync+3 · Imapsync+3

Derlinkman · Publicado 2023-03-03 · Atualizado 2023-03-09 · CVE-2023-26490

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions mailcow versions prior to the 2023-03 Update

Description The Sync Job feature in mailcow, a dockerized email package, suffers from a shell command injection. This allows a malicious user to obtain shell access to the Docker container running dovecot by abusing the vulnerability. The imapsync Perl script, which implements the necessary functionality for this feature, including the XOAUTH2 authentication mechanism, creates a shell command to call openssl. However, since different parts of the specified user password are included without any validation, one can simply execute additional shell commands. The default ACL for a newly-created mailcow account does not include the necessary permission.

Recommendations As a temporary workaround, consider removing the Syncjob ACL from all mailbox users to prevent creating or changing existing Syncjobs. Update to the 2023-03 Update or later to fix the issue.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-26490

GHSA-3J2F-WF52-CJG7

Produtos afetados

Dovecot

Imapsync

Mailcow

Openssl

Referências · 7

• 🔥 https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3j2f-wf52-cjg7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26490.json · Exploit
• https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-03 · Nota
• https://t.me/cvenotify/45888 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26490 · Aviso do Fabricante
• https://t.me/cibsecurity/59419 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26490 · Nota de Segurança