PT-2023-20680 · Imapsync+3 · Imapsync+3

Derlinkman · Published 2023-03-03 · Updated 2023-03-09 · CVE-2023-26490

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions mailcow versions prior to the 2023-03 Update

Description The Sync Job feature in mailcow, a dockerized email package, suffers from a shell command injection. This allows a malicious user to obtain shell access to the Docker container running dovecot by abusing the vulnerability. The imapsync Perl script, which implements the necessary functionality for this feature, including the XOAUTH2 authentication mechanism, creates a shell command to call openssl. However, since different parts of the specified user password are included without any validation, one can simply execute additional shell commands. The default ACL for a newly-created mailcow account does not include the necessary permission.

Recommendations As a temporary workaround, consider removing the Syncjob ACL from all mailbox users to prevent creating or changing existing Syncjobs. Update to the 2023-03 Update or later to fix the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-26490

GHSA-3J2F-WF52-CJG7

Affected Products

Dovecot

Imapsync

Mailcow

Openssl

References · 7

• 🔥 https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-3j2f-wf52-cjg7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26490.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-26490 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26490 · Security Note
• https://github.com/mailcow/mailcow-dockerized/releases/tag/2023-03 · Note
• https://t.me/cvenotify/45888 · Telegram Post
• https://t.me/cibsecurity/59419 · Telegram Post