PT-2017-17890 · Squirrelmail · Squirrelmail

Dawid Golunski + 1 · Published 2017-04-20 · Updated 2026-05-20 · CVE-2017-7692

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SquirrelMail versions prior to 20170427 0200-SVN

Description The issue allows post-authentication remote code execution via a mishandled sendmail.cf file in a popen call. This can be exploited to execute arbitrary shell commands on the remote server. The problem lies in the Deliver SendMail.class.php file, specifically in the initStream function, which incorrectly uses escapeshellcmd() to sanitize the sendmail command. The sendmail command line, particularly the -f$envelopefrom part, is vulnerable to injection of arbitrary command parameters due to the lack of whitespace escaping. If the target server uses sendmail and SquirrelMail is configured to use it, an attacker can trick sendmail into using a malicious sendmail.cf file, leading to arbitrary command execution. This can be achieved by uploading a sendmail.cf file as an email attachment and then injecting the filename with the -C option in the "Options > Personal Informations > Email Address" setting.

Recommendations For SquirrelMail versions prior to 20170427 0200-SVN, as a temporary workaround, consider disabling the use of sendmail as a command-line program in SquirrelMail configuration until a patch is available. Restrict access to the Deliver SendMail.class.php file to minimize the risk of exploitation. Avoid using the envelopefrom variable in the sendmail command line until the issue is resolved. Update to a version newer than 20170427 0200-SVN to fully resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-7692

DLA-941-1

DSA-3852-1

MGASA-2017-0121

Affected Products

Squirrelmail

References · 20

• 🔥 https://exploit-db.com/exploits/41910 · Exploit
• 🔥 https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7692 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7692 · Security Note
• https://advisories.mageia.org/MGASA-2017-0121.html · Security Note
• https://osv.dev/vulnerability/DSA-3852-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3852 · Vendor Advisory
• https://security.gentoo.org/glsa/201709-13 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7692 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7692 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7692 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0121 · Vendor Advisory
• https://github.com/fatedier/frp · Note
• https://github.com/EddieIvan01/iox · Note
• https://bugs.mageia.org/show_bug.cgi?id=20703 · Note