PT-2024-5037 · Mailcow · Mailcow

Alchemist · Published 2024-04-04 · Updated 2025-10-06 · CVE-2024-30270

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions: mailcow:dockerized versions prior to 2024-04

Description: The issue is related to the rspamd maps() function and involves improper path validation, allowing for path traversal and arbitrary code execution. This can enable an authenticated admin user to overwrite any file writable by the www-data user, potentially leading to the execution of arbitrary commands on the server.

Recommendations: For versions prior to 2024-04, update to version 2024-04 or later, which contains a patch for the issue. As a temporary workaround, consider restricting access to the rspamd maps() function to minimize the risk of exploitation. Additionally, ensure that proper access controls and permissions are in place for the www-data user to prevent unauthorized file overwrites.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-05564

CVE-2024-30270

GHSA-4M8R-87GC-3VVP

Affected Products

Mailcow

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30270.json · Exploit
• 🔥 https://github.com/Alchemist3dot14/CVE-2024-30270-PoC · Exploit
• 🔥 https://sonarsource.com/blog/remote-code-execution-in-mailcow-always-sanitize-error-messages · Exploit
• 🔥 https://vicarius.io/vsociety/posts/mailcow-with-xss-and-path-traversal-cve-2024-31204-and-cve-2024-30270 · Exploit
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-4m8r-87gc-3vvp · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05564 · Security Note
• https://osv.dev/vulnerability/CVE-2024-30270 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30270 · Security Note
• https://twitter.com/rfwaveio/status/1803950887443816652 · Twitter Post
• https://mailcow.email/posts/2024/release-2024-04 · Note
• https://twitter.com/gossy_84/status/1803872970722447730 · Twitter Post
• https://twitter.com/axcheron/status/1809347629039431763 · Twitter Post
• https://twitter.com/gossy_84/status/1803872969787089312 · Twitter Post
• https://t.me/defcon_news/124353 · Telegram Post
• https://t.me/aptreports/10663 · Telegram Post