PT-2024-22152 · Postal · Postal

Arthurzenika · Published 2024-03-11 · Updated 2024-03-12 · CVE-2024-27938

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Postal versions less than 3.0.0

Description The issue allows for SMTP Smuggling attacks, which may enable incoming e-mails to be spoofed. This could allow an incoming e-mail to be received by Postal, appearing to be from a server that a user has authorized to send mail on their behalf, but was not the genuine author of the e-mail. The problem does not affect sending outgoing e-mails, as e-mail is re-encoded with <CR><LF> line endings when transmitted over SMTP.

Recommendations For versions less than 3.0.0, upgrade to Postal v3.0.0 or higher to resolve the issue. Once upgraded, Postal will only accept End of DATA sequences which are explicitly <CR><LF>.<CR><LF>, and non-compliant sequences will be logged to the SMTP server log.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2024-27938

GHSA-J42R-6C99-HQF2

Affected Products

Postal

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27938.json · Exploit
• 🔥 https://postfix.org/smtp-smuggling.html · Exploit
• https://github.com/postalserver/postal/security/advisories/GHSA-j42r-6c99-hqf2 · Vendor Advisory
• https://github.com/postalserver/postal/commit/0140dc4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27938 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27938 · Vendor Advisory
• https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide · Note
• https://twitter.com/CVEnew/status/1767301376068268455 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1767348808873087317 · Twitter Post